syspolicyd high CPU on Mac? Gatekeeper, explained
syspolicyd using high CPU on your Mac is Gatekeeper checking apps as they launch. Here's why it spikes (often an app launching binaries in a loop) and the safe way to calm it.
syspolicyd is the daemon behind Gatekeeper: it decides what's allowed to run on your Mac. High CPU means it's assessing an app's security, and it usually subsides once that app is checked and cached. When it doesn't, the cause is almost always another app making it re-check constantly.
What syspolicyd does
It enforces system policy: what may be installed, loaded, or executed. It maintains the policy database and is the process other parts of macOS ask for a Gatekeeper verdict. Since macOS Mojave it also handles notarization checks, and it authorizes kernel extension loading. The real one lives at /usr/libexec/syspolicyd, protected by System Integrity Protection.
Why it's using high CPU
Gatekeeper runs an assessment when you launch an app: scanning the bundle, validating its signature, checking notarization, and (with trustd) the signing certificate. Real spikes come from:
- First launch of a large, newly-downloaded (quarantined) app: the full scan runs once.
- An app that repeatedly spawns signed binaries. A documented case involved a developer tool whose file-watcher spawned thousands of
gitprocesses per second, each one forcing a fresh Gatekeeper check and pushingsyspolicydtoward 180% CPU. - Deprecated or blocked kernel extensions it keeps re-evaluating.
Is syspolicyd a virus?
No. The real /usr/libexec/syspolicyd is core macOS security and the Gatekeeper enforcer. Disabling it weakens your Mac's protection. As always, verify the process's path before trusting any "syspolicyd virus" claim.
What to do about it
- Usually, wait it out. First-launch and scan spikes subside once the app is registered and results cache.
- If it's sustained, find the app triggering it. Check Console for repeated security-assessment logs, then quit, update, or uninstall the app whose launches drive it. (In the developer-tool case above, the fix came from the app's vendor, not macOS.)
- Reboot to clear a transient loop.
- Don't try to permanently disable it: that's turning off Gatekeeper.
What people get wrong
The old assumption is that Gatekeeper only checks an app on its first run. That was true on older macOS. On Ventura and later, malware (XProtect) and code-integrity scans run on every launch; only the notarization result caches (about 12 hours). Repeated checking is expected behavior, not a bug.
See which app is making it work
syspolicyd spiking is a clue that some app is launching binaries over and over. Plumby shows live CPU with each process named plainly and the fix beside it, so you can trace the security-check load back to the app causing it instead of guessing, measured from your Mac's real state.
