--- title: "softwareupdated: what it is, why it downloads so much, and whether to block it · Kilobat" url: "https://kilobat.app/processes/softwareupdated" description: "softwareupdated checks for and downloads macOS updates. Why it uses gigabytes, how to stop automatic downloads on a hotspot, and what breaks if you block it." --- Updates and downloads # What is softwareupdated? `softwareupdated` is the macOS Software Update daemon. It checks for macOS updates and downloads them. The Automatic Updates options in System Settings decide when it downloads without asking. Process: `softwareupdated` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It checks for and downloads macOS updates, security responses and system files. Don’t block Don't block it for long. The Mac stops getting macOS and security updates. On a hotspot, turn off automatic downloads instead. Path `/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated` launchd label `com.apple.softwareupdated` Signing identifier `com.apple.softwareupdated` ## What it is The man page calls it “the main daemon responsible for running software updates”. The program is inside the Software Update app in `/System/Library/CoreServices`. System Settings › General › Software Update and the `softwareupdate` command both use it. Apple Platform Security says that every update of a Mac with Apple silicon needs a network connection to Apple. Apple's installation server signs each update for the specific device. For over-the-air updates, Apple says that only the components needed for the update download, not the whole operating system. ## Why it uses the network - **Checks for updates.** macOS checks for new updates in the background. A check is small. - **Downloads of updates.** With “Download new updates when available” on, it downloads macOS updates without asking. - **Security responses and system files.** Apple lists “Install Security Responses and system files” as a separate automatic option. Background Security Improvements, from macOS 26.1, are lightweight security releases between updates. ## How much is normal Checks are small and short. Large downloads after Apple releases an update are expected. A macOS update can be several gigabytes. On a hotspot, one update can use a large part of a data plan. That's when to change the settings below. ## When it uses a lot, and why - **A new macOS release.** With automatic downloads on, the update downloads as soon as macOS finds it, often in the background. - **You click Update Now.** With automatic downloads off, the whole update downloads when you start it. Do this on your usual network. - **Content Caching on the network.** Apple says that a Mac with Content Caching can keep software updates, so other devices don't download them again. They still need to contact Apple to complete the update. ## Is it safe to block? Don’t block Don't block it for long. The Mac stops getting macOS and security updates. On a hotspot, turn off automatic downloads instead. What breaks if you block it - macOS updates and upgrades can't download or install. Apple's server must sign each update. - Security responses and system data files stop arriving, so security fixes fall behind. - Software Update in System Settings and the `softwareupdate` command can't check for updates. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Choose Apple menu › System Settings › General › Software Update. Click the Info button next to Automatic Updates. 2. Turn off “Download new updates when available”. Click Done. 3. Install the updates later, on your usual network. Software Update still shows them. 4. Keep security updates current. Turn the option on again when you are back on an unmetered network. 5. Don't quit `softwareupdated` in Activity Monitor. macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `softwareupdated` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p 'softwareupdated' -P ``` ## With Kilobat 1. In the Kilobat app list, search for `softwareupdated`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'softwareupdated' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'softwareupdated' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [mesu.apple.com](https://kilobat.app/hosts/mesu-apple-com): Apple's host for software update catalogs, the lists of updates that devices check against. - [swscan.apple.com](https://kilobat.app/hosts/swscan-apple-com): An Apple host for macOS updates, listed in Apple's software update section. - [swdist.apple.com](https://kilobat.app/hosts/swdist-apple-com): An Apple host for macOS updates, listed in Apple's software update section. - [swdownload.apple.com](https://kilobat.app/hosts/swdownload-apple-com): An Apple host for macOS update downloads. Apple says that it works through proxies. - [swcdn.apple.com](https://kilobat.app/hosts/swcdn-apple-com): Apple's host for macOS update downloads. Big transfers from it are macOS updates. - [updates.cdn-apple.com](https://kilobat.app/hosts/updates-cdn-apple-com): Apple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms. - [gs.apple.com](https://kilobat.app/hosts/gs-apple-com): An Apple host that devices need during setup and for operating system updates. Apple lists it in both sections of its host list. - [gdmf.apple.com](https://kilobat.app/hosts/gdmf-apple-com): Apple's software update catalog host. Device management services also ask it which updates are available. - [xp.apple.com](https://kilobat.app/hosts/xp-apple-com): An Apple host that Apple lists in the software update section of its host list, without saying what it does. - [*.aaplimg.com](https://kilobat.app/hosts/aaplimg-com): An Apple domain behind Apple's content delivery. Many apple.com hosts resolve to names under it, so connections show up with it. - [*.cdn-apple.com](https://kilobat.app/hosts/cdn-apple-com): An Apple content delivery domain. Apple lists it for iCloud services; update and sign-in hosts sit under it too. ## Questions **Does Low Data Mode stop Software Update?** Apple describes Low Data Mode only as a way to reduce data use. To be sure, turn off “Download new updates when available”. **Is it safe to turn off automatic downloads?** Yes, for a short time. You lose no updates. Install them when you are back on your usual network. **Can I see what it is downloading?** Run `softwareupdate --list` in Terminal. It lists the updates that macOS found. ## Sources - softwareupdated(8) and softwareupdate(8), man pages installed with macOS 27.2 - [Apple Support: Software Update settings on Mac](https://support.apple.com/guide/mac-help/software-update-settings-on-mac-mchla7037245/mac) - [Apple Support: Keep your Mac up to date](https://support.apple.com/guide/mac-help/keep-your-mac-up-to-date-mchlpx1065/mac) - [Apple Platform Security: Secure software updates](https://support.apple.com/guide/security/secure-software-updates-secf683e0b36/web) - [Apple Platform Security: Background Security Improvements](https://support.apple.com/guide/security/background-security-improvements-sec87fc038c2/web) - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) Checked on 1 November 2026. ## Related - [mobileassetd](https://kilobat.app/processes/mobileassetd): Part of macOS, not documented by Apple. Kilobat sees it download system assets such as Apple Intelligence models, voices, fonts and dictionaries. - [appstoreagent](https://kilobat.app/processes/appstoreagent): Part of macOS. They download and update apps from the App Store, so app downloads show under them, not under the App Store app. - [AssetCache](https://kilobat.app/processes/assetcache): Part of macOS. It is Content Caching. It keeps Apple downloads on this Mac and gives them to other Apple devices on the same network. - [nsurlsessiond](https://kilobat.app/processes/nsurlsessiond): Part of macOS. It does background downloads and uploads that apps hand to macOS, so its traffic belongs to those apps. - [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot) - [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot) - [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data)