FSEvents is Apple’s macOS filesystem event system for directory-level change notifications. It tells applications when files or folders change, move, or are created, without requiring them to read the file contents. Backup tools, sync clients, search indexers, and monitoring software use it because it is efficient and designed for broad change tracking.
In security, FSEvents matters because directory activity can leak metadata. Even when documents are protected, an observer who can access the relevant event stream or watch a parent directory may infer user behavior from timing, file names, and repeated change patterns. That can reveal clues about app launches, downloads, project activity, or other routine work. Defenders should limit watcher scope, keep sensitive data in less exposed paths, and review macOS permissions for processes that subscribe to filesystem events. The risk is not file theft by itself; it is the signal left behind by normal file activity.