A light instance for providing a security service, the light instance comprising: a data storage; and a processor communicatively coupled to the data storage, the processor being configured to: store a plurality of security policies corresponding to a plurality of client content segments in the data storage; receive a first client content segment; determine a first client content segment identifier based on the content of the first client content segment; select a first security policy from the plurality of security policies based on the first client content segment identifier; apply the first security policy to the first client content segment; receive a second client content segment; determine a second client content segment identifier based on the content of the second client content segment; determine that the plurality of security policies does not contain a valid security policy for the second client content segment based on the second client content segment identifier; and characterized in that, the light instance is further arranged to: send a security analysis request to a central instance in response to the determination that the plurality of security policies does not contain the valid security policy, and wherein the application of the first security policy comprises configuring the processor to: send a client a message based on the first security policy; receive a client response; and admit or decline the client content segment based on the client response; wherein the first security policy comprises a warning of a potential security risk, and, storage of the client response to automate acceptance or rejection of the client content segment at a future time. a data storage; and a processor communicatively coupled to the data storage, the processor being configured to: store a plurality of security policies corresponding to a plurality of client content segments in the data storage; receive a first client content segment; determine a first client content segment identifier based on the content of the first client content segment; select a first security policy from the plurality of security policies based on the first client content segment identifier; apply the first security policy to the first client content segment; receive a second client content segment; determine a second client content segment identifier based on the content of the second client content segment; determine that the plurality of security policies does not contain a valid security policy for the second client content segment based on the second client content segment identifier; and characterized in that, the light instance is further arranged to: send a security analysis request to a central instance in response to the determination that the plurality of security policies does not contain the valid security policy, and wherein the application of the first security policy comprises configuring the processor to: send a client a message based on the first security policy; receive a client response; and admit or decline the client content segment based on the client response; wherein the first security policy comprises a warning of a potential security risk, and, storage of the client response to automate acceptance or rejection of the client content segment at a future time. store a plurality of security policies corresponding to a plurality of client content segments in the data storage; receive a first client content segment; determine a first client content segment identifier based on the content of the first client content segment; select a first security policy from the plurality of security policies based on the first client content segment identifier; apply the first security policy to the first client content segment; receive a second client content segment; determine a second client content segment identifier based on the content of the second client content segment; determine that the plurality of security policies does not contain a valid security policy for the second client content segment based on the second client content segment identifier; and characterized in that, the light instance is further arranged to: send a security analysis request to a central instance in response to the determination that the plurality of security policies does not contain the valid security policy, and wherein the application of the first security policy comprises configuring the processor to: send a client a message based on the first security policy; receive a client response; and admit or decline the client content segment based on the client response; wherein the first security policy comprises a warning of a potential security risk, and, storage of the client response to automate acceptance or rejection of the client content segment at a future time. send a client a message based on the first security policy; receive a client response; and admit or decline the client content segment based on the client response; wherein the first security policy comprises a warning of a potential security risk, and, storage of the client response to automate acceptance or rejection of the client content segment at a future time.