What is syspolicyd on a Mac?

27 October 2026 · 5 min read

syspolicyd is the macOS process that checks apps before they are allowed to open. It is the engine behind Gatekeeper, the feature that decides whether an app you downloaded is safe to run. It can use the processor for a while after you install or open a lot of apps, and that is normal. It is part of macOS’s security, so leave it alone.

If you found it at the top of a process list, it almost certainly means one thing: macOS is checking something that is about to run.

What syspolicyd does

When you open an app for the first time, especially one you downloaded, macOS checks it. It looks at whether the app is signed by a known developer, whether Apple has notarized it, and whether anything about it has changed. If the checks pass, the app opens. If not, you see a warning that the app cannot be opened or could not be verified.

syspolicyd is the process that does these checks. Foreman’s one-line description says it plainly: it checks apps with Gatekeeper before they open. The checks involve reading the app, checking its signature and, in many cases, looking up information about it. They can also involve contacting Apple, which is why your network may show some activity while it does.

You do not control it, and it has no window. It is nearly always running in the background, and mostly idle.

Why it gets busy

syspolicyd’s use goes up when there is more to check. The common causes:

Installing or updating many apps at once. A new Mac setup, or a round of app updates, hands it a lot of new files to check.
Opening a big app for the first time. Apps made of many parts, such as a creative suite or a game, have many files to verify.
Running new programs repeatedly. People who build software, and so produce new programs again and again, may see it busy because each new program is a fresh thing to check.
After a macOS update. The first launches after an update often involve more checking than usual. Why is my Mac slow after a macOS update covers the other background work that piles up then.
A slow or missing network. If it has to contact Apple and the connection is poor, a check can take longer, and the app may appear to hang for a moment before it opens.

In each case the busy spell is short and ends once the checks are done.

Is it a virus or a problem?

No. syspolicyd is part of macOS, and it protects you. The real one is /usr/libexec/syspolicyd, in the protected system area of the Mac that regular programs cannot write to, and it runs as root.

If it seems to use a lot of the processor for a long time with nothing new being opened, there are a few ordinary things to try:

Wait. If you just installed several apps, give it a few minutes.
Quit the app that is starting repeatedly. An app that crashes and reopens in a loop can make macOS check it again and again.
Restart the Mac. This clears any check that has stuck.
Make sure the Mac is up to date in System Settings, General, Software Update, since problems with the checks themselves are fixed in macOS updates.

If it is still pegged after that, look at what else is running. How to see which app is using the most CPU on a Mac will show whether another app is the real cause, with syspolicyd just reacting to it.

Can you turn it off?

There are ways people try to turn off Gatekeeper, and I would not follow them. Gatekeeper is a main reason a downloaded app cannot quietly run something harmful. Turning it off to save a few seconds of processor time trades away real protection. And ending the process does nothing useful: macOS starts it again, and an app that was opening at that moment may stall until it is back.

If an app you trust is blocked, the right way is to try to open it once, then go to System Settings, Privacy & Security, where the Security section offers Open Anyway for the app that was just blocked. Do that only for an app you are sure about.

If the real annoyance is that apps feel slow the first time they open, that is the checking at work. The second launch is usually much faster, because the result is remembered.

Seeing it in Foreman

Foreman is a Task Manager for macOS, and it names syspolicyd “App security checks”, with the real name in grey, and says it checks apps with Gatekeeper before they open. That is exactly what you want to know when you see it in a list. Sort the CPU column and, if you have just installed apps, you will often see the row spike and then fall away, which tells you it is a one-time check and not a fault.

It is also a case where Foreman will not tempt you. syspolicyd runs as root, so Foreman asks for an administrator password before ending it, and Efficiency Mode and Suspend are not offered for it at all. For a process like this one the right choice is to do nothing. If you want to learn more about what each of the other background names means, how to find out what’s running in the background on your Mac is the place to start.

The short version

syspolicyd checks apps with Gatekeeper before they open.
It gets busy after you install or open many apps, or after an update.
It is not malware, and it is not something to fix.
Do not try to end it or turn Gatekeeper off. macOS restarts it, and the protection is worth keeping.
If it stays busy for long, restart the Mac and look for an app that keeps crashing and reopening.

Foreman is free for 24 hours, then $12 once, if you want plain names on the rest of the list.