What is softwareupdated on Mac?

What softwareupdated does

softwareupdated runs as root from /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated. It:

• checks Apple’s catalog for macOS updates, security responses, Safari updates and command line tools
• downloads them (often via nsurlsessiond)
• prepares them: verifies the download and builds the new sealed system snapshot
• installs background security data like XProtect and Gatekeeper rules without a restart

Why it uses CPU and disk

The prepare step is the heavy one. An update is delivered as a compressed patch that has to be verified, expanded and applied to a copy of the system volume. On Apple Silicon that means several minutes of high CPU and a lot of disk writes. Major upgrades (for example Sequoia to Tahoe) take longer than point releases.

Other reasons:

• Repeated failures: low disk space, a flaky network or a beta enrollment mismatch makes it retry.
• Command Line Tools: if you installed Xcode’s CLT, updates for them also arrive through softwareupdated.

How to see what it’s doing

softwareupdate --list

Watch progress in the install log:

tail -f /var/log/install.log | grep -i softwareupdate

Check your automatic update settings from Terminal:

defaults read /Library/Preferences/com.apple.SoftwareUpdate

How to make it calm down

1. Let a prepare finish. Quitting it mid-way usually means it starts over later.
2. Free up disk space. A major update can need 20–30 GB free to prepare.
3. Move updates to a time that suits you: System Settings › General › Software Update › Automatic Updates (ⓘ). Turn off “Download new updates when available” and “Install macOS updates”, but leave Install Security Responses and system files on.
4. Install when convenient: softwareupdate --install --all --restart from Terminal, or the button in System Settings.

When to worry

softwareupdated should only run from inside Software Update.app in /System/Library/CoreServices:

ps -o user,pid,command -p $(pgrep -x softwareupdated)

Be suspicious of anything else that claims to update macOS: pop-ups in a browser, a “Software Update” app in Downloads, or an installer asking for your password from a website. Apple updates only come through System Settings, the App Store, or softwareupdate.

Seeing it in Stat Space

Stat Space shows CPU, disk I/O and free space together, so a “preparing update” burst reads clearly as one event rather than a mystery slowdown. Its CPU history (30 days) shows when it happened, and the Disk tab’s free-space view tells you whether you have room for the next upgrade.