Within minutes of the announcement of an update to macOS or one of its security components like XProtect, news of that is propagated across many websites, including this one, and in other social media. Yet many of those who then check Software Update are told that their Mac is up to date and can’t find any updates. This article explains how that can occur, and what you can do about it.

There are two important exceptions: those Macs on networks where there’s a local Content Caching server, and updates for the primary copy of XProtect data in Macs running macOS 15 Sequoia and later. Content Caching problems are discussed more in this article, and the problem of XProtect is covered at the end.

All macOS and its security data (apart from recent XProtect) updates are normally fetched by Software Update in General settings, or alternatively at the command line by softwareupdate, also used by my free SilentKnight. They work through the softwareupdated service that should be running in the background. If you run a local Content Caching server, then softwareupdated should automatically connect to that and ask it for the update; otherwise, it tries to connect to Apple’s software update servers over the internet. Although this chain is usually reliable, it has several points of weakness.

Likely cause

The most likely reasons for being unable to find these updates are:

• Apple’s software update servers are in heavy demand, and are temporarily refusing new connections. As Apple often releases multiple updates at once, this isn’t uncommon, particularly in the autumn/fall with the new versions of macOS and other OSes. The only solution is to try again later, although sometimes you can kickstart the process by running SilentKnight or softwareupdate. Apple provides a page showing the status of its many internet services, where these are listed as macOS Software Update, but transient problems due to load seldom get reported there.
• Your Mac, or its Content Caching server if you’re running one, can’t connect to Apple’s servers because of a network fault. Again the only solution is to try again later, in the hope that the fault has been fixed.
• softwareupdated or your Content Caching server aren’t working properly. This is normally rectified by restarting that Mac and trying again once it’s up and running. In some cases, it can require the Mac to be started up in Safe mode before the update becomes available. This has long been one of the purposes of Safe mode.

For macOS updates, you must ensure there’s sufficient space for the update to be prepared and installed. This is checked when Software Update checks for available updates. Although insufficient space should be reported as the reason for not offering an update that would otherwise be available, that may not always be fed back clearly to the user.

Try again

If an update has only been released in the last few hours, it may not be available yet on the servers nearest your Mac. Some parts of the world may lag by several hours, or it may appear that updates are only available for one architecture. Either way, if you have time you should leave it an hour before checking again. If you still can’t find the update then, try restarting your Mac and trying again.

When updates still aren’t found, try kickstarting the process by checking with SilentKnight or softwareupdate. This is easiest for Apple silicon Macs running macOS Sequoia 15.6 or later, where you can click on the List Updates tool in SilentKnight3 to run the optimal command of
softwareupdate -l --include-config-data
as explained here. When you find the macOS update you’re looking for, you should check again with Software Update in System Settings, which provides a complete human interface and can proceed to download and install that update correctly.

Persistent failure

Although the great majority of early failures turn into success within a few hours at most, some persist through multiple restarts and repeated use of softwareupdate. Others may find the unwanted update to the latest version of macOS, but not a security update for a previous version, such as 15.7.7 to 15.7.8. Discovering where this is going wrong requires a deep dive into the log, or maybe handing the problem over to Apple Support.

To get a clean log extract, use SilentKnight3’s List Updates tool, or the softwareupdate command given above, as the trigger at time zero. Setting a predicate of the subsystems of com.apple.SoftwareUpdate or com.apple.SoftwareUpdateMacController should elicit most of the key entries. The following notes are taken from complete log records from Sequoia running in a VM, with times given in seconds after initiation by a click at 0.756 seconds.

Discovery of available macOS updates relies on a series of Finite State Machines, as I have described previously. Log entries are copious, and many are expansive state dumps, as summarised for a macOS update in Tahoe.

First, catalogue download should result in a set of MobileAsset receipt results including available and compatible macOS updates:
01.555498 com.apple.mobileassetd Catalog download for: com.apple.MobileAsset.MacSoftwareUpdate got: 4 assets
Those are then filtered to produce a shortlist
01.560700 com.apple.SoftwareUpdateMacController [POLICY] 2 assets left after filtering for highest major assets in SUCorePolicy

Next the sizes required to prepare and apply the updates are estimated, before reporting those updates are still available:
01.565691 com.apple.SoftwareUpdateMacController [FSM(scan[78047C9B-31A5-5DFF-833D-FADE3ED4EAE5])] [S] QueryingSUMetadata [E] QueryMetadataUpdateAvailable [N] Idle [A] ScanSuccess info:
[]]] majorPrimaryDescriptor: macOS 26.6 25G72 (Customer)
majorSecondaryDescriptor: macOS 26.6 25G72 (Customer)
minorPrimaryDescriptor: macOS 15.7.8 24G824 (Customer)
minorSecondaryDescriptor: macOS 15.7.8 24G824 (Customer)
additionalInfo: { } [[[]
(where angle brackets have been replaced by square brackets).

com.apple.mobileassetd then runs its auto-stager on the possible macOS updates. Once that’s complete, security data updates are discovered from the catalog. Note these should include any Safari update required if the user opts to install 15.7.8:
02.066269 com.apple.SoftwareUpdate 5 updates found:
012-04872 | MRTConfigData 1.93
061-06985 | Gatekeeper Compatibility Data 1.0
089-33637 | XProtectPayloads 157
140-66475(R) | Safari 26.6
140-75749 | XProtectPlistConfigData 5353

Finally, any additional supplementary updates such as Siri Understanding, and documentation, are listed, although those aren’t reported by softwareupdate.

XProtect in Sequoia and later

The primary copy of XProtect’s security data has moved, and softwareupdate can only update a secondary copy. In Sequoia and Tahoe, open Terminal and enter the command
sudo xprotect check
then authenticate with your admin password when prompted. That should force XProtect management to look for the current version available from iCloud. If it finds a newer version than that already installed in the new location, enter
sudo xprotect update
to download it from iCloud and install it. If the xprotect check command returns an error, try again in an hour so.

Currently, this doesn’t appear to work in Golden Gate betas, which invariably report an error, but we’re still awaiting an explanation for that.