softwareupdated is the macOS daemon that checks Apple's servers for macOS and security updates and downloads them in the background; it runs as the _softwareupdate system account and is part of macOS. Heavy CPU or network use from it means an update is downloading or being prepared, so let it finish, or change what it does on its own in System Settings > General > Software Update > Automatic Updates.
Last reviewed · 1 source
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated |
|---|---|
| Runs as | _softwareupdate, a macOS system account |
| Signed by | Apple (Software Signing), identifier com.apple.softwareupdated |
| Note | A second softwareupdated, in MobileSoftwareUpdate.framework, was also running as _softwareupdate. |
softwareupdated is the macOS background daemon responsible for checking, downloading, and preparing system software updates. It periodically contacts Apple's update servers to determine if new macOS updates, security patches, or XProtect signature updates are available. When updates are found, it can download them in the background and notify you that an update is ready to install.
High CPU usage while checking for or downloading large macOS updates in the background
Significant network bandwidth consumption during background update downloads
Disk space issues when softwareupdated downloads a large update without sufficient free space
Process running persistently after a failed or interrupted update download
Run 'softwareupdate -l' in Terminal to list all available updates. This shows what softwareupdated has found and is trying to download. If a large update is pending, the background download activity is expected and will resolve once the download completes.
Go to System Settings > General > Software Update > Automatic Updates. Here you can control whether updates are downloaded automatically. Disabling 'Download new updates when available' will prevent softwareupdated from using bandwidth in the background, but you will need to manually check for updates.
If a download seems stuck, restart your Mac, then open System Settings > General > Software Update or run 'softwareupdate -l' to check again. Don't try to empty /Library/Updates by hand: on current macOS it's a folder System Integrity Protection guards.
Run 'sudo killall softwareupdated' in Terminal. launchd will restart it when the next update check is scheduled. This clears any stuck state from a failed update attempt and resets the daemon's connection to Apple's update servers.
softwareupdated running briefly while checking for updates is completely normal — it contacts Apple's servers periodically. Be concerned if it uses high CPU or network bandwidth continuously for more than 2 hours, which may indicate a stuck download or a corrupted update cache.
launchd is the first process that runs when macOS boots (PID 1) and serves as the system's init and service management f...
XProtect is the malware protection built into macOS. Apple describes signature-based detection and removal of malware, w...
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications....
Cado Security (now part of Darktrace) found Cthulhu Stealer rented out by the 'Cthulhu Team' over Te...
Genieo is a browser hijacker that behaves like adware: it acts as a search engine that shows sponsor...
System Settings › Privacy & Security › Input Monitoring
No. softwareupdated is Apple's official software update daemon built into macOS. It is responsible for keeping your system up to date with the latest security patches and macOS versions. It is code-signed by Apple and protected by System Integrity Protection. Seeing it in Activity Monitor is normal, especially when it is checking for or downloading updates.
softwareupdated downloads macOS updates in the background when automatic updates are enabled. Major macOS updates can be several gigabytes in size, which may noticeably consume bandwidth. You can check what is downloading with 'softwareupdate -l' in Terminal. To prevent background downloads, disable 'Download new updates when available' in System Settings > General > Software Update > Automatic Updates.
While you can temporarily stop it with 'sudo killall softwareupdated,' it will restart on its next scheduled check. You can reduce its activity by disabling automatic updates in System Settings, but it is not recommended to completely prevent update checks, as security patches are critical for protecting your Mac. Security-only updates (like XProtect signatures) are particularly important to receive promptly.
High CPU from softwareupdated usually occurs when it is actively downloading, verifying, or preparing an update for installation. Large updates require cryptographic verification of every component, which is CPU-intensive. This is temporary and should resolve within 1-2 hours. If it persists longer, restart your Mac and check for updates again.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser