Laptop slow after security software install: diagnose and fix it

TL;DR — If your laptop got slow right after security software was installed, the most common cause is the security agent doing a first-time full scan or using too much CPU, disk, or memory because of an outdated policy or agent version. Start by checking Task Manager on Windows or Activity Monitor on Mac to see whether the security app is at the top for CPU, Memory, or Disk, then update the agent and pause or reschedule heavy scans through the security app or your IT/provider dashboard. Reading time: ~6 min

The scenario

It is a normal Tuesday afternoon. You open your laptop, sign in, and everything feels sticky: apps take longer to launch, typing lags for a second, and the fan starts spinning even though you only have email, a browser, and chat open. You remember that the new security software was installed earlier today or this week, and now Zoom stutters, file saves take longer, and opening a large project folder makes the machine crawl. You want to know whether the security tool is actually the cause and what you can safely do next.

Symptoms

• The slowdown started shortly after endpoint security or EDR (endpoint detection and response) software was installed or updated.
• The laptop fan runs loudly while you are doing light work.
• Apps take much longer to open than before.
• Typing or clicking feels delayed for 1-3 seconds.
• File Explorer or Finder becomes slow when opening folders with many files.
• Video calls stutter or audio breaks up when the laptop is busy.
• Battery drains faster than usual.
• In Windows Task Manager, a security-related process is near the top under CPU, Memory, or Disk.
• In Mac Activity Monitor, the security app or its helper process shows high % CPU or Energy Impact.
• You may see messages like:

Scanning in progress
Real-time protection is on
Updating security intelligence
Device is being analyzed

Likely causes

Step-by-step diagnosis

1. Confirm the timing

   • Action: Think back to when the slowdown started and compare it to the install/update time shown in the security app.
   • Menu path: Open the security app → About, Version, or History.
   • This is your problem if: the slowdown began the same day as the install, update, or policy change.
   • Jump to: Fixes after you finish steps 2 and 3.

2. Check whether the security app is using the laptop heavily

   • Windows path: Press Ctrl+Shift+Esc → Processes tab → click CPU, then Memory, then Disk.
   • Mac path: Applications → Utilities → Activity Monitor → sort by % CPU, then check Memory and Disk tabs.
   • This is your problem if: the security app, agent, scanner, or helper process stays near the top for several minutes, especially above roughly 20-30% CPU or with sustained high disk usage while you are idle.
   • Jump to: Security agent process is using high CPU, disk, or memory.

3. Check whether a full scan or update is running

   • Action: Open the security app.
   • Common path: Home/Status, Protection, or Scan.
   • This is your problem if: you see wording like "scan in progress," "analyzing files," "updating signatures/intelligence," or a progress bar that is moving.
   • Jump to: First-time full scan is running after install or Agent is outdated or stuck on a bad update.

4. Test whether the slowdown is tied to one folder or app

   • Action: Open the app or folder that feels especially slow, such as a cloud-sync folder, Downloads, a project folder with thousands of files, or a folder with ZIP/VM/media files.
   • Windows quick check: In Task Manager, keep Processes open while opening that folder.
   • Mac quick check: In Activity Monitor, watch the security process while opening that folder.
   • This is your problem if: the security process spikes immediately when you open that specific folder or app.
   • Jump to: Too many files are being scanned in a busy folder.

5. Check for a second antivirus or security tool

   • Windows path: Settings → Apps → Installed apps and search for terms like antivirus, endpoint, security, protection, defender, EDR.
   • Mac path: Applications folder, then System Settings → General → Login Items.
   • This is your problem if: you find two active security products installed at the same time, especially if both provide real-time scanning.
   • Jump to: Conflicting security tools are both scanning the same files.

6. Check whether scans are scheduled during your workday

   • Action: Open the security app or your provider's dashboard policy.
   • Common path: Scan, Schedule, Policy, or Device policy.
   • This is your problem if: a full scan is scheduled during business hours or at login.
   • Jump to: Scheduled scan is running during working hours.

[You notice slowdown]
          |
          v
[Task Manager/Activity Monitor]
          |
          v
[Security app high usage?] ---- yes ----> [Check scan/update status]
          |                                   |
          no                                  v
          |                            [Scan or update running?]
          v                                   |
[Check specific folder/app]                   v
          |                            [Apply scan/update fix]
          v
[Spikes on one folder?] ---- yes ----> [Tune exclusions/scope]
          |
          no
          |
          v
[Check for 2nd security tool and schedules]

Fixes

First-time full scan is running after install

A first full scan is normal after many endpoint security installs, but it should not run at the worst possible time.

• Open the security app and look for Pause, Stop scan, or Reschedule.
• If your app is managed and those buttons are disabled, ask your provider or IT admin to move the full scan to after hours in the device policy.
• Keep the laptop plugged in and leave it idle for 30-60 minutes so the first scan can finish faster.

If you have a managed Windows environment with Microsoft Defender, an admin can check scan state with:

Get-MpComputerStatus | Select-Object FullScanAge,QuickScanAge,AntivirusSignatureLastUpdated,RealTimeProtectionEnabled

Verify it worked: the security app no longer shows an active scan, and CPU/disk usage drops within a few minutes.

Security agent process is using high CPU, disk, or memory

• First, reboot the laptop once. This clears stuck helper processes and pending updates.
• Then open the security app → About/Version → Check for updates.
• If there is a Performance, Battery, or Silent mode, turn it on temporarily during calls or presentations.
• If the app is managed by your provider, send them a screenshot of Task Manager or Activity Monitor showing the process name and usage for 2-3 minutes.

Windows quick commands you can copy if your support team asks for details:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name,CPU,PM

Get-CimInstance Win32_Process | Sort-Object WorkingSetSize -Descending | Select-Object -First 10 ProcessName,@{n='MemoryMB';e={[math]::Round($_.WorkingSetSize/1MB,1)}}

Mac Terminal alternative if requested:

top -o cpu -l 5 | head -40

Verify it worked: after reboot/update, the security process no longer stays at the top under CPU or Disk during idle use.

Agent is outdated or stuck on a bad update

• Open the security app → About, Version, or Updates.
• Click Check for updates and let it finish.
• If it shows an error, reboot and try again on a stable network.
• If it still fails, uninstalling and reinstalling may be required, but only if your provider confirms that is safe for your policy.

⚠️ If the laptop is company-managed, do not uninstall the security agent on your own unless your provider or IT admin tells you to. Removing endpoint protection can violate policy and leave the device unprotected.

Windows Defender example checks:

Update-MpSignature

Get-MpComputerStatus | Select-Object AMServiceEnabled,AntispywareEnabled,AntivirusEnabled,AntivirusSignatureVersion,EngineVersion

Verify it worked: the app shows current version/signatures and the repeated high usage after update checks stops.

Too many files are being scanned in a busy folder

This is common with cloud-sync folders, developer folders with thousands of small files, virtual machine images, large ZIP files, and media caches.

• Identify the folder that triggers the spike.
• Ask your provider or IT admin to add a targeted exclusion for that folder type if policy allows it.
• Better than excluding a whole drive: exclude only the exact high-churn path or file type.

Examples your provider may use on Windows Defender:

Add-MpPreference -ExclusionPath "C:\Users\%USERNAME%\AppData\Local\Temp"

Add-MpPreference -ExclusionExtension ".vhdx"

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

On Mac, exclusions are usually set in the security product policy rather than a universal OS command.

Verify it worked: opening the previously slow folder no longer causes a large CPU or disk spike in the security process.

Conflicting security tools are both scanning the same files

• Keep only one real-time scanning product active unless your provider explicitly supports the combination.
• On Windows, go to Settings → Apps → Installed apps and remove the older or duplicate tool your provider tells you to remove.
• On Mac, remove the duplicate security app from Applications, then restart if your provider confirms it is the correct one to remove.

⚠️ Uninstalling the wrong security product can break compliance or remote support. Confirm the exact product name with your provider before removing anything.

Windows uninstall example if your support team provides the exact package name:

Get-Package | Sort-Object Name | Select-Object Name,Version

Verify it worked: only one active security product remains, and the laptop no longer shows two security processes competing for CPU/disk.

Scheduled scan is running during working hours

• Open the security app → Scan, Schedule, or Policy.
• Move full scans to evenings, lunch breaks, or weekends.
• Prefer quick scans during work hours and full scans after hours.
• If you cannot edit schedules locally, ask your provider to change the device policy.

Windows Defender scheduled task example for admins:

Get-ScheduledTask -TaskPath "\Microsoft\Windows\Windows Defender\" | Select-Object TaskName,State

Verify it worked: the next scheduled scan no longer starts during your normal work hours, and the laptop stays responsive.

Prevention

• Roll out security agents in stages, not to every laptop at once. Test on 3-5 devices first and watch CPU, memory, and disk for one business day.
• Pin scan schedules to after hours in policy. For example: quick scan at lunch, full scan overnight or weekends.
• Create a reviewed exclusion list for high-churn paths. Keep it narrow and documented, for example:

{
  "approvedExclusions": [
    "C:\\Users\\*\\AppData\\Local\\Temp",
    "*.vhdx",
    "project cache folders approved by IT"
  ]
}

• Track agent version and update health. In your provider dashboard, add a report for devices with old agent versions or failed content/signature updates.
• Capture a baseline before rollout. Record idle CPU, memory pressure, disk activity, and battery impact before and after install so regressions are obvious.
• Avoid overlapping real-time scanners. In software inventory reviews, flag devices with more than one antivirus/EDR product installed and remove duplicates before new deployments.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.