Answer used to be that if you were completely updated, and running an OS still supported by Apple it wasn't necessary (and that you were cautious about what sites you visit, how you deal with email attachments, and site downloads.) However, new security issues have come to light and running a free AV like Sophos might be worthwhile. I have started using Sophos on my Snow Leopard, with no problems.
Warning: you are likely to get some very dogmatic replies to this question from some "true believers."
OS X already includes everything it needs to protect itself from viruses and malware. Keep it that way with software updates from Apple. Ill-conceived third party "anti-virus" garbage products are the primary reason for Mac instability, crashes and related problems reported on this site.
A much better question is "how should I protect my Mac":
- Never install any product that claims to "speed up", "clean up", "optimize", or "accelerate" your Mac. Without exception, they will do the opposite.
- Never install pirated or "cracked" software, software obtained from dubious websites, or other questionable sources. Illegally obtained software is almost certain to contain malware.
- Don’t supply your password in response to a popup window requesting it, unless you know what it is and the reason your credentials are required.
- Don’t open email attachments from email addresses that you do not recognize, or click links contained in an email:
- Most of these are scams that direct you to fraudulent sites that attempt to convince you to disclose personal information.
- Such "phishing" attempts are the 21st century equivalent of a social exploit that has existed since the dawn of civilization. Don’t fall for it.
- Apple will never ask you to reveal personal information in an email. If you receive an unexpected email from Apple saying your account will be closed unless you take immediate action, just ignore it. If your iTunes or App Store account becomes disabled for valid reasons, you will know when you try to buy something or log in to this support site, and are unable to.
- Don’t install browser extensions unless you understand their purpose. Go to the Safari menu > Preferences > Extensions. If you see any extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone.
- Don’t install Java unless you are certain that you need it:
- Java, a non-Apple product, is a potential vector for malware. If you are required to use Java, be mindful of that possibility.
- Disable Java in Safari > Preferences > Security.
- Block browser popups: Safari menu > Preferences > Security > and check "Block popup windows":
- Popup windows are useful and required for some websites, but popups have devolved to become a common means to deliver targeted advertising that you probably do not want.
- Popups themselves cannot infect your Mac, but many contain resource-hungry code that will slow down Internet browsing.
- If you ever see a popup indicating it detected registry errors, that your Mac is infected with some ick, or that you won some prize, it is 100% fraudulent. Ignore it.
- Ignore hyperventilating popular media outlets that thrive by promoting fear and discord with entertainment products arrogantly presented as "news". Learn what real threats actually exist and how to arm yourself against them:
- The most serious threat to your data security is phishing. To date, most of these attempts have been pathetic and are easily recognized, but that is likely to change in the future as criminals become more clever.
- OS X viruses do not exist, but intentionally malicious or poorly written code, created by either nefarious or inept individuals, is nothing new.
- Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.
- If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
- Most such utilities will only slow down and destabilize your Mac while they look for viruses that do not exist, conveying no benefit whatsoever - other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.
- Do install updates from Apple as they become available. No one knows more about Macs and how to protect them than the company that builds them.
Summary: Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.
OS X already includes everything it needs to protect itself from viruses and malware.
No longer true, according to Tom Reed.
Unfortunately, it may be time to advise that the average Mac user start using some kind of third-party anti-virus software, rather than relying on Apple to protect them.