What is XProtect on a Mac, and why is it scanning?

XProtect is Apple’s built-in malware protection for the Mac. It checks apps and files against a list of known harmful software, and macOS runs it on its own schedule in the background. If you see XProtect or XprotectService using the processor, your Mac is doing a routine security check. It is normal and you should leave it alone.

Nothing needs to be installed to get it. It comes with macOS, and Apple updates its list of known malware through Software Update’s automatic updates, so you do not need to run it by hand.

What XProtect does

XProtect is one layer of macOS’s security. Its job is to recognize malware. Apple keeps a list of known harmful software, and XProtect compares apps and files against it. If something matches, macOS can stop it from opening and tell you.

It works together with Gatekeeper, which checks an app’s signature and notarization when you open it. What syspolicyd is on a Mac explains that side. Gatekeeper asks whether an app comes from a developer Apple knows and has been checked. XProtect asks whether the app matches known malware. They cover different questions, and both run without your help.

You may see several names in a process list, all starting with XProtect or Xprotect: XProtect itself, XprotectService, XProtectPluginService, and sometimes others such as XProtectRemediator followed by a code name. They are parts of the same feature, and they run as root.

Why it is scanning

XProtect runs when there is something new to look at, and on a schedule macOS sets. The usual triggers:

• After you download or open a new app. The check happens when a file or app is first opened.
• After an app changes. An app that has been modified on disk is checked again.
• After XProtect’s own definitions update. Apple can update the list of known malware without a full macOS update. When it does, macOS may check again against the new list.
• In the background. macOS also runs scans of its own at times it chooses, without anything new being opened.

Apple does not publish the schedule, so I cannot tell you exactly when it will run. What matters is that it is automatic, and there is no setting for you to change.

Is it normal for it to use a lot of CPU?

For a short time, yes. A scan that has just started can use a good share of the processor and then drop back to nothing. You may hear the fans for a bit on an older Mac or one under load.

It is worth a closer look only if it stays busy for a long stretch, for hours with nothing else going on. In that case:

1. Restart the Mac. A scan that got stuck usually clears.
2. Check System Settings, General, Software Update. Fixes to the way the scanning works arrive through updates.
3. Look at what else is running. Scans take longer when the Mac is busy, so another app hogging the processor can make XProtect look worse than it is. High CPU usage on a Mac: what counts as high and what to do helps you tell.

A very long scan might also be reading a lot of files, such as after you copied a large folder of apps or downloads onto the Mac.

Can you turn it off?

No, and you should not try. XProtect is built into macOS and has no on and off switch, and ending its processes does nothing lasting, because macOS starts them again. What you can do is keep it current: in System Settings, General, Software Update, leave the automatic updates for security responses and system files turned on. The scanning is one reason many people use a Mac without a separate security program.

It is also worth being careful about “XProtect” in a place it does not belong. The real one lives inside macOS, and you never download it. If a website, pop-up or email tells you to install an “XProtect” tool, or to call a number about it, that is a scam. The real XProtect never asks you to download anything, pay, or phone anyone. The most it does is tell you a file is harmful and offer to move it to the Trash.

What if I think my Mac has malware?

A scan in the background is not a sign you are infected. It is the routine. Signs that something is actually wrong look different: new browser home pages you did not choose, pop-ups that appear when no browser is open, apps you did not install, or a Mac that is slow and hot all the time even when you are doing nothing. Check the list of apps in the Applications folder, look in System Settings at General > Login Items & Extensions (Login Items on macOS 14) for things you do not recognize under Open at Login and Allow in the Background, and keep macOS up to date.

If a download is blocked with a message that it contains malware, believe it and move it to the Trash.

Seeing it in Foreman

Foreman is a Task Manager for macOS, and it shows XProtect and XprotectService as “XProtect malware scan”, with the real names in grey and a note that this is Apple’s built-in malware scanner. They run as root, so they sit under System processes, and Foreman does not offer Efficiency Mode or Suspend for them. If a fan has spun up and you are wondering why, sort the CPU column on the Processes page. If the scan row is on top for a minute or two and then drops, you have your answer. If it is another app at the top, the scan was a bystander. If you want to find that other app, how to find out what’s running in the background on your Mac will help.

Foreman will not scan for malware or remove anything. It is not a security tool, and it will not clean your Mac. What it does is name what is running, in words that do not need a search. Foreman is free for 24 hours, then $12 once.

The short version

• XProtect is Apple’s built-in malware scanner, part of macOS.
• It runs when apps are first opened or changed, when its list updates, and on its own schedule.
• A burst of processor use is normal and ends by itself.
• You cannot turn it off, and ending it only makes macOS restart it.
• A website telling you to install XProtect is a scam.