macOS processes › Security and privacy
What is XProtect on Mac?
XProtect is Apple's built-in antimalware for macOS. It checks apps for known malware when they open and runs periodic background scans that can remove infections.
What it does
XProtect's malware signatures are updated by Apple separately from macOS updates. Besides checking apps at launch, it runs remediation scans in the background. During those you may see processes named XProtect, or XProtectRemediator followed by a malware family's name. Those names describe what's being scanned for, not something that was found. Running xprotect version in Terminal shows the installed version.
Why it gets busy
- A scheduled background scan, which reads through apps and files.
- Checking a newly downloaded or updated app when it first opens.
- Applying a new signature update.
Why is XProtect using so much CPU?
XProtect is running a malware scan or checking a new app. Scans are periodic and finish on their own, and there's no need to stop them.
Is it safe to quit?
It's part of your Mac's protection, and macOS starts it again for the next scan.
Apple's XProtect lives in /Library/Apple/System/Library/CoreServices/XProtect.app. Something named XProtect elsewhere, or one that asks for your password, is not Apple's.
How to calm it down
- Let scans finish. They're periodic and usually short.
- Keep Install Security Responses and system files turned on under System Settings › General › Software Update › Automatic Updates, so XProtect stays current.
- Run
xprotect versionin Terminal if you want to see which version is installed.
In SystemWatch
SystemWatch labels XProtect as Malware protection, so you can see at a glance that the scan is Apple's and not something you installed.
