What is XProtect (XprotectService) on Mac?

XProtect is Apple's built-in malware protection, on every Mac. You'll see it in Activity Monitor as XprotectService, and sometimes as XProtect, XProtectBridgeService or XProtectUpdateService. It's safe.

Key points

• XProtect checks apps and files against known malware.
• It gets busy scanning after a rules update, or checking newly downloaded files.
• Leave it running: it's part of the Mac's protection.

What XProtect does

Apple keeps a list of known malware and updates it on its own, separately from macOS updates. XProtect uses that list to check apps when they're opened and when their files change, and to look for known threats in the background. If it finds one, macOS tells you and offers to move it to the Trash.

Why is XprotectService using so much CPU?

Scans after a rules update, or checking newly downloaded files. A big download, or many new files at once, means more to check.

In one reading of a MacBook Pro (M1 Max, 64 GB) on October 10, 2026, XprotectService was using 0.0% of the CPU and 6.5 MB of memory (the 2 of its 6 copies that could be measured).

Can I quit XprotectService?

Leave it running: macOS needs it. Quitting it would only pause your Mac's malware checks until macOS starts it again.

How to check it

1. Open Activity Monitor: press Command-Space, type "Activity Monitor" and press Return.
2. Type XProtect in the search field at the top right.
3. Look at % CPU and Memory. Several copies with XProtect in their name are normal.

Questions

Is XprotectService a virus?

No. It's part of XProtect, Apple's built-in malware protection on every Mac.

Why is XprotectService using so much CPU?

It's scanning: after its rules update, or while checking newly downloaded files. It settles once the scan is done.

Do I need antivirus software if my Mac has XProtect?

XProtect covers known malware and updates on its own. Keeping macOS up to date and downloading apps from the App Store or developers you trust matters most.