You have the following options for downloading and installing updates to macOS and its security data:

• Software Update settings, where you can opt to download and install them automatically, or manually;
• the softwareupdate command tool;
• third-party utilities such as my free SilentKnight.

This article explains how you can use the second of those. SilentKnight is explained in detail here for version 2, and here for version 3 (Apple silicon only).

softwareupdate documentation

Neither the man page for softwareupdate nor its current usage information are complete or accurate, and they have remained in that state since at least macOS Sierra in 2016, ten years ago. The man page claims to have been last updated in 2012, 14 years ago, and the examples given there still refer to standalone EFI firmware updates, although it refers to Rosetta and Apple silicon Macs, demonstrating that it has actually been updated more recently.

There are three critical details those fail to explain:

• --include-config-data option isn’t mentioned in either man or usage, although it’s required to include security data updates such as those to XProtect;
• -l or --list options don’t list all appropriate update labels or available updates as claimed by man and usage, even when used with the -a option, but omit entries for security data updates such as those to XProtect;
• in macOS Sequoia and later, the active copy of XProtect data is managed by the xprotect command tool rather than softwareupdate.

If you were to rely on the man page or usage info, you’d never find any security data updates, such as those to XProtect and XProtect Remediator, and those would remain out of date.

Listing available updates

The commands
softwareupdate -l
and
softwareupdate -la
will list available macOS updates, as well as some others, but results omit security data updates such as those to XProtect (e.g. XProtectPlistConfigData_10_15-5353), and XProtect Remediator (e.g. XProtectPayloads_10_15-157).

To obtain a full list of available updates, the correct command is
softwareupdate -l --include-config-data

This should return a list with a label for each available update, such as
Finding available software
Software Update found the following new or updated software:
* Label: XProtectPayloads_10_15-157
Title: XProtectPayloads, Version: 157, Size: 23593KiB, Recommended: YES,
* Label: XProtectPlistConfigData_10_15-5353
Title: XProtectPlistConfigData, Version: 5353, Size: 1281KiB, Recommended: YES,
* Label: macOS Tahoe 26.6-25G72
Title: macOS Tahoe 26.6, Version: 26.6, Size: 7721694KiB, Recommended: YES, Action: restart,

Note the labels given for security data updates contain no spaces, whereas that for the macOS update contains two.

Downloading updates

Although just downloading updates isn’t recommended, security data updates should still come as Installer packages, and could be installed conventionally. This is best performed individually if required, using the command
softwareupdate -d --include-config-data [label]
where the label is that given in the list of available updates. Downloaded security data updates should then be saved to folders inside /Library/Updates, but macOS updates are carefully hidden, and can only be installed using Software Update or softwareupdate with its install option.

Installing updates

If no macOS update is available, install all available updates using the command
softwareupdate -ia --include-config-data

Installing individual security data updates that are available can be performed using the command
softwareupdate -i --include-config-data [label]
where the label is that given in the list of available updates.

If you do use either of those to obtain a macOS update, you’ll be prompted to enter your password before download starts. Terminal then displays a percentage “downloading” which apparently includes preparation. That may appear to freeze at 98.51%, and when it finally reaches 100% you’ll need to open Software Update settings and complete the installation from there.

Full installers

The following command lists available macOS installers:
softwareupdate --list-full-installers

The current list can include:

• Tahoe 26.1, 26.2, 26.3.1, 26.3.2, 26.4, 26.4.1, 26.5, 26.5.1, 26.5.2, 26.6
• Sequoia 15.7.2, 15.7.3, 15.7.4, 15.7.5, 15.7.7, 15.7.8
• Sonoma 14.8.2, 14.8.3, 14.8.4, 14.8.5, 14.8.7, 14.8.8
• Ventura 13.7.8
• Monterey 12.7.4, 12.7.6
• Big Sur 11.7.10, 11.7.11
• Catalina 10.15.6, 10.15.7 builds 19H2, 19H15
• Mojave 10.14.6
• High Sierra 10.13.6

but that given will include only those compatible with the Mac used to obtain the list. When you want to download one of them, use the command
sudo softwareupdate --fetch-full-installer --full-installer-version 26.5.2
giving the version you want. If you want a version not listed for your Mac, check with one of the sites that provides links to a fuller list, such as Mr. Macintosh.

Rosetta

On Apple silicon Macs only, use the command
sudo softwareupdate --install-rosetta --agree-to-license
to download and install Rosetta 2 and avoid its normal installation dialog.

XProtect in Sequoia and later

softwareupdate maintains the copy of XProtect data in /Library/Apple/System/Library/CoreServices/XProtect.bundle, the sole copy in macOS up to and including Sonoma. From Sequoia onwards, the primary copy is in /var/protected/xprotect/XProtect.bundle and isn’t maintained by softwareupdate, although that does still maintain a secondary copy in the old location.

Thus, Macs running Sequoia and later need to update two separate copies of XProtect.bundle, one using softwareupdate and the other by a background service which can be directed through a new xprotect command.

The following commands can be used to maintain the new primary location in Sequoia and later:

• xprotect version returns the version of XProtect.bundle currently installed in the new location.
• sudo xprotect check returns the version of XProtect.bundle currently available from the iCloud connection used to update XProtect in its new primary location.
• sudo xprotect update downloads an update from its iCloud connection and installs that in its new primary location.

In some older versions of the command, sudo xprotect update could also update the new primary location from an updated copy in the old location, but that can now only be performed by the background service updating XProtect.

Thus the sequence of commands required is:

1. xprotect version to check the version installed. If that’s lower than the version available from softwareupdate, proceed to check the iCloud update source.
2. sudo xprotect check to determine whether a newer version is available from iCloud. If it is, proceed to update.
3. sudo xprotect update to download and install the update from iCloud.

Although this currently works in macOS Sequoia and Tahoe, in Golden Gate betas sudo xprotect check returns an error, and no updates can be obtained manually from iCloud, leaving XProtect’s background service to update the primary location automatically. It’s unclear whether that’s intended or a permanent change.

Command summary

• softwareupdate -l --include-config-data to obtain a list of available updates;
• softwareupdate -ia --include-config-data to download and install all available updates, when there’s no macOS update available;
• softwareupdate -i --include-config-data [label] to install available updates individually by label, when there’s a macOS update available;
• Software Update settings to download and install any macOS updates;
• softwareupdate --list-full-installers to list available full installers;
• sudo softwareupdate --fetch-full-installer --full-installer-version [version] to download a full installer for the specified version of macOS;
• sudo xprotect check and sudo xprotect update to update new location of XProtect.bundle, Sequoia and later.