Barney-15E wrote:
Sure, it can give false positives, it can delete files that shouldn't be deleted, and can make parts of the system inaccessible.
Using the default settings (which Sophos strongly recommends) Sophos Home Edition will not delete anything without the user's permission, period.
In the default mode, only the "on access" scanner is active, & it only scans files after they are downloaded, before they are executed or made available to other executable files. In this respect, it is just like the AV software Apple builds into the OS.
The on access scanner does not scan already installed system files. You can do that if you run the "on demand" scanner, but only if you include the system level folders in that scan. If you want, you can do that after installing Sophos to catch anything malicious that might have been installed before the software was installed, but there is no reason to run the on demand scanner more than once if you let the on access scanner do its job.
As for false positives, like I said, I never saw any signs of that over all the years I used it. It did detect & quarantine several email attachments containing Windows malware sent to me by not-so-security-conscious friends & associates, but since I use the default settings they were not deleted & if I wanted to, I could have opened them to see what they contained.
Of course, like any other software files, components of Sophos can be corrupted by external events & it can be interfered with by other, incompatible software installed by the user. In particular, so-called system "enhancements" that don't follow Apple's developer guidelines can cause all kinds of problems. But I have never, ever seen any indication that Sophos itself causes any problems with well written software of any kind.