Should you click Run anyway?

“Windows protected your PC” means Microsoft Defender SmartScreen does not recognize the app yet: the file has no track record, and often no code signature. It is a warning about the unknown, not a malware verdict. Clicking Run anyway is reasonable only when you know who made the file, downloaded it from their official site, and checked that it matches a checksum they publish.

This guide explains that warning and its Mac and Linux cousins, gives you four questions to answer before you click, and shows a checksum check with real output. Our worked example is Cyborb, a desktop AI agent from Orbioom. It is our product, and its Windows and Linux builds are unsigned betas.

01What does “Windows protected your PC” mean?

It means SmartScreen looked up the file’s reputation and found too little to vouch for it. Microsoft says SmartScreen weighs two signals: whether the file is signed by a known publisher, and whether this exact file has been downloaded by many people without trouble.

A code signature is the developer’s verified name, stamped on the file so that any later change breaks it. According to Microsoft’s documentation for developers:

• Unsigned files get the “Windows protected your PC” screen. You have to choose More info, then Run anyway, and a workplace policy can remove that option.

• Signed but new files still get a warning, but it shows the verified publisher’s name.

• Reputation takes time. Microsoft says there is no exact threshold, and it can take several weeks and hundreds of clean installs.

• Unsigned apps start over with every update, because reputation cannot carry across versions without a signature.

• Extended Validation certificates no longer skip the warning. That shortcut was removed in 2024.

SmartScreen also warns when a file matches its list of programs reported as unsafe. That is a different situation: delete the file.

Windows 11 has a stricter layer called Smart App Control. It blocks unsigned apps unless they already have a good reputation, and Microsoft says there is no way to make an exception for a single app. The only way through is to turn Smart App Control off, which recent Windows updates let you undo later without reinstalling Windows.

02The warnings you may see, compared

Each system handles unknown apps differently. Checked on September 28, 2026, against each vendor’s documentation.

03Is it safe to click Run anyway?

It is safe enough when all four statements below are true. If any is false, or you are not sure, stop. An app you run can do anything your account can do, including reading your documents, browser data and API keys.

Microsoft gives developers the same advice from the other side: tell early users they may see a SmartScreen prompt, and that they should continue only after checking the publisher and the download source.

04How do I verify a download’s checksum?

Compute the file’s checksum on your computer and compare it with the value the developer publishes. If every character matches, you have exactly the file the developer listed.

We ran this on a Mac with a small stand-in file, since this guide downloads no real installers. Many developers publish a .sha256 file next to the download, and -c checks your file against it:

$ shasum -a 256 demo-installer.bin
b0bbd8640efc4b6806a2c9c53c63bd24215857e77c1125a06bb125d8ab49ba5d  demo-installer.bin

$ shasum -a 256 -c demo-installer.bin.sha256
demo-installer.bin: OK

$ printf "x" >> demo-installer.bin

$ shasum -a 256 -c demo-installer.bin.sha256
demo-installer.bin: FAILED
shasum: WARNING: 1 computed checksum did NOT match

$ shasum -a 256 demo-installer.bin
14bad11823bec9f936e335b791d56c63ac82e1a3799e2818a8157324440cc97a  demo-installer.bin

Adding a single letter to the end of the file changed the whole fingerprint. That is what makes a checksum useful: a corrupted, swapped or tampered file cannot quietly match.

On Linux, the same commands are sha256sum file and sha256sum -c file.sha256. On Windows, PowerShell’s Get-FileHash does the job. These lines follow Microsoft’s documentation; we did not run them on a Windows machine for this guide:

Get-FileHash .\Downloads\app-setup.exe -Algorithm SHA256
(Get-FileHash .\Downloads\app-setup.exe).Hash -eq "PASTE-THE-PUBLISHED-VALUE"

The second line prints True or False. Microsoft’s own example compares a download against a published hash exactly this way.

05What about a Mac: “Apple cannot check this app”?

That message comes from Gatekeeper, and it means Apple has not notarized the app. Notarization is Apple’s check of a developer’s software for known malicious content before release.

Apple’s own steps to open such an app, if you are sure of its source:

1. 01

   Try to open the app once

   The warning appears and the app does not open. That is expected.

2. 02

   Open Privacy & Security

   Go to System Settings, choose Privacy & Security, and scroll down.

3. 03

   Click Open Anyway

   Confirm when the warning appears again. Apple saves the app as an exception, so it opens normally from then on.

Two other prompts look similar but mean different things. An app that is signed and notarized still asks once whether you want to open something downloaded from the internet; that is routine. An app that macOS moves to the Trash because it contains malware should stay there.

06Linux: how do I run an AppImage safely?

Make the file executable, then run it. Linux shows no reputation warning for an AppImage, so every check in this guide is up to you.

chmod +x my.AppImage
./my.AppImage

In a file manager, the same switch is a checkbox in the file’s properties, called “Allow executing file as program” in Files and “Is executable” in Dolphin. If you see an error saying AppImages require FUSE, install libfuse2 (named libfuse2t64 on Ubuntu 24.04), or run the file with --appimage-extract-and-run.

AppImages can carry a GPG signature, but running one does not check it. The AppImage project points to a separate validate tool for that, so for most people a checksum is the practical check.

07Cyborb’s Windows and Linux builds are unsigned betas

Cyborb, our product, ships three desktop builds. The macOS build for Apple Silicon is signed and notarized by Apple. The Windows x64 and Linux x64 AppImage builds are unsigned betas, and our download page says so. Checked on September 28, 2026:

• Windows: the page says SmartScreen may show “Windows protected your PC” on first run, and to choose More info, then Run anyway. It publishes each release’s file size and SHA-512 checksum at updates.cyborb.ai/latest.yml.

• Linux: the page says to make the AppImage executable with chmod +x before opening it. The same kind of entry for the AppImage is in updates.cyborb.ai/latest-linux.yml.

Those checksums are SHA-512 values written in base64, a compact text encoding, rather than the more common hexadecimal. On Linux or a Mac, these lines compare your download with the published value. We tested them on a stand-in file, since we did not download the real installer:

cd ~/Downloads
curl -fsSL https://updates.cyborb.ai/latest-linux.yml -o latest-linux.yml
expected=$(grep -m1 "sha512:" latest-linux.yml | awk '{print $2}')
actual=$(openssl dgst -sha512 -binary Cyborb-*.AppImage | openssl base64 -A)
[ "$expected" = "$actual" ] && echo "Checksum OK" || echo "MISMATCH: do not run this file"

Our stand-in printed Checksum OK, and after we added one character to it, MISMATCH: do not run this file. On Windows, these PowerShell lines do the same comparison with the value from latest.yml; as above, we could not run them on Windows:

$expected = "PASTE-THE-sha512-VALUE-FROM-latest.yml"
$hex = [BitConverter]::ToString([Convert]::FromBase64String($expected)) -replace "-", ""
(Get-FileHash .\Downloads\Cyborb-*.exe -Algorithm SHA512).Hash -eq $hex

A quicker, weaker check is the file size: right-click the installer, choose Properties, and compare the size in bytes with the size line in the file. Because the checksum lives on the same domain as the download, it guards against a corrupted or swapped file, not against someone who controls cyborb.ai. A code signature closes that gap; the macOS build has one, and the Windows and Linux builds do not yet.

08When to walk away

The last two are classic scam patterns. Our guide to AI scams covers the pressure tactics, and our guide to curl | bash covers pasted commands.

09FAQ

Next, read how to check an install script before you run it, or get comfortable with the basics in the terminal for beginners.