macOS processes › Security and privacy
What is XprotectService on Mac?
XprotectService is the part of Apple's XProtect that scans files for known malware, for example when you open a newly downloaded app, disk image or installer.
What it does
It's a helper service inside the XprotectFramework in /System/Library/PrivateFrameworks. Other parts of macOS, like Gatekeeper, call it to compare files against XProtect's malware signatures. A related daemon, xprotectd, runs from /usr/libexec. The lowercase p in the name is Apple's spelling.
Why it gets busy
- Opening a large, newly downloaded app, archive or disk image.
- Developer builds or downloads that produce many new programs.
Why is XprotectService using so much CPU?
XprotectService is checking files for malware, usually a newly downloaded app or disk image. It's brief and part of normal protection.
Is it safe to quit?
It starts again for the next check, so quitting only delays your Mac's protection.
The real XprotectService lives inside /System/Library/PrivateFrameworks/XprotectFramework.framework.
How to calm it down
- Let it finish checking large downloads before opening them again.
- Unpack big archives and install apps one at a time.
- Keep XProtect updates on in System Settings › General › Software Update › Automatic Updates.
In SystemWatch
In the website edition of SystemWatch you can see the files XprotectService has open, which shows exactly what it's checking.
