Apps for the Mac are signed by their developer and sent to Apple, which scans them and attaches a "notarization" stamp. When you open a download, macOS checks the stamp. Most apps have one and open after a single "downloaded from the internet, are you sure?" question.
The message Apple could not verify "X" is free of malware means there is no stamp: the app is old, home-made, or the developer skipped the step. It is not proof of anything bad, but it is the moment to ask where the download came from.
If you trust it, open it this way (macOS 15 and later; right-click → Open no longer works):
- Try to open the app once, so macOS records the attempt.
- System Settings → Privacy & Security, scroll down to the Security section.
- Next to the note about the blocked app, click Open Anyway and enter your password.
macOS remembers the choice for that app. There is no antivirus to install; this check and the built-in XProtect scanner are the protection.