What is softwareupdated on Mac?

Last updated: 2026-07-31

What it is

softwareupdated is Apple’s main software-update daemon for macOS. It is launched by launchd as a system service and coordinates the update work that applies to the Mac: checking what is available, downloading the required material, preparing it, and installing it. Its scope includes macOS updates and full macOS upgrades.

Firmware updates are not suspicious extra software that softwareupdated happens to fetch separately. Apple includes Mac firmware updates within macOS updates. That means firmware-related work can legitimately appear as part of an ordinary operating-system update flow.

The name also does not mean that softwareupdated updates every application on the computer. Mac App Store applications use a separate update mechanism, so activity from this daemon should not be interpreted as a complete record of all third-party application updates.

Why it talks to the network

Several events can wake the update flow. Opening Software Update can trigger it directly. macOS also performs periodic background checks, and a device restart may lead to another check. Requests made with the softwareupdate command-line tool can activate the service as well. On a managed Mac, an organization’s update policy may initiate or require update activity.

To determine what applies to the Mac, the update flow contacts the Apple Software Update Catalogue. The catalogue supplies information about applicable releases and where their files can be downloaded. When an update is selected, its payload may come from Apple’s download or CDN services. A Mac can also receive it from a local Content Cache instead of fetching the full payload directly from Apple.

Network activity can continue beyond the initial catalogue check and file transfer. During installation, the system may need to contact Apple services for verification or device personalization. A managed device’s complete update flow may additionally communicate with the organization’s device-management service.

It is important not to assign every connection in that wider flow to one executable without evidence. Apple has not publicly guaranteed that softwareupdated itself directly creates every Apple or device-management connection involved in an update. The process is the main coordinator, but the public information does not provide a complete process-by-process map for every network request.

How much traffic is normal

There is no reliable universal byte range for softwareupdated. Apple has not published a traffic allowance that applies across all macOS releases, Mac models, update types, and installation states. A precise claim such as a fixed number of megabytes per day would therefore be unverified.

When no applicable update is available, the work is usually limited to catalogue and metadata checks. Those checks are small compared with an actual update payload. Traffic rises when the Mac downloads system data, security updates, Safari, or other system software. A macOS update is larger still, while a complete upgrade can approach the scale of an operating-system installer.

Context matters more than a single traffic total. A burst that coincides with a visible or pending update is consistent with the job of softwareupdated. Persistent downloading when Software Update shows nothing visible or pending deserves further diagnosis, but the process name alone cannot show whether the activity is normal, stalled, or malicious.

Can you turn it off

The practical recommendation is to keep softwareupdated. Apple does not provide a supported System Settings switch for completely uninstalling or disabling this daemon. Ending it is not a durable substitute: because it is an on-demand system service, launchd may start it again when update work is requested.

You can control automatic behavior at:

Apple menu > System Settings > General > Software Update > the information button next to Automatic Updates

There you can turn off options such as downloading new updates when available or installing macOS updates. Depending on the available macOS settings, the same area can also control installation of system data files and security updates. These switches change automatic update behavior; they do not disable softwareupdated itself.

After automatic downloading or installation is turned off, you can still check for and install updates manually. The tradeoff is delay: macOS updates may remain unapplied until you act. Turning off system data files and security updates can also delay malware-protection configuration and other background security improvements. A Mac managed by an organization may continue to follow its device-management update policy regardless of the user-facing settings.

What people get wrong

• “softwareupdated is a virus or a third-party telemetry program.” It is neither. Apple ships it with macOS, and launchd manages it as a system software-update service.

• “It only checks for updates; it never downloads or installs anything.” That description is incomplete. softwareupdated is the main daemon for running software updates, and the workflow covers checking, downloading, preparing, and installing.

• “Firmware updates are suspicious extra software downloaded by this process.” Apple includes Mac firmware updates within macOS updates. Firmware-related traffic in an update flow is not, by itself, evidence of an unrelated download.

• “Killing or deleting it is a safe network optimization.” softwareupdated is an on-demand system service and may be relaunched by launchd. Forcibly disabling it can break normal updating and delay security fixes, while Apple offers no supported System Settings control for removing the daemon.

• “Turning off automatic installation guarantees that it will never connect again.” Automatic installation is only one trigger and one setting. Manual update checks, independently enabled automatic downloads, system security-data behavior, restart-related checks, and management policies can still cause update communication.

• “A large transfer proves the process is abnormal.” High traffic fits the role of softwareupdated when it is downloading a macOS update or upgrade. If substantial downloading continues for a long time with no visible or pending update, that is a reason to investigate further—not enough information to declare the process either harmless or malicious.

Seeing what it actually used

First check Software Update for visible or pending work, then observe the same time window in Bytetally’s per-process statistics. Compare softwareupdated traffic with when the check, download, preparation, or installation occurred. If sustained transfers have no matching update activity, preserve that timeline as the starting point for further diagnosis.

Related processes

Common questions