macOS processes › Security and privacy
What is endpointsecurityd on Mac?
endpointsecurityd runs Apple's Endpoint Security system, which lets approved security software watch events like apps launching and files being opened. If it's busy, a security tool on your Mac is usually the reason.
What it does
Antivirus, endpoint protection and monitoring tools install an Endpoint Security extension, and macOS sends them the events they subscribe to. endpointsecurityd manages those extensions; the security app decides what to do with each event.
Why it gets busy
- A security app that subscribes to every file open or program launch.
- Heavy file activity, like builds or backups, which creates more events for the security tool to review.
- An outdated security tool after a macOS update.
- Two or more security tools running at once.
Why is endpointsecurityd using so much CPU?
endpointsecurityd's load comes from the security tools using it. Updating or reconfiguring the antivirus or monitoring app is the fix.
Is it safe to quit?
macOS relies on it to run your security tools. Stopping it can leave them unable to protect you.
How to calm it down
- See which tools are installed in System Settings › General › Login Items & Extensions, under Endpoint Security Extensions.
- Update your security software, especially after a macOS update.
- On a work Mac, ask IT before changing anything. They may be able to exclude heavy folders like build directories.
- Don't run two antivirus products at the same time.
In SystemWatch
SystemWatch's History shows endpointsecurityd's load next to your security app's, which helps you show IT exactly when the slowdown happens.
