A computer implemented method at a client for making a determination concerning whether a software application running on a system is benign or malicious, said method comprising: extracting metadata about the application; gathering contextual information concerning the system, wherein the contextual information includes recent infection history, applications running on the system, web sites visited, geographic location of the client, the Internet Protocol, IP, address of the client and a client identifier; transmitting the metadata and the contextual information to a server component; receiving a response from the server component relating to a determination as to whether the application is benign or malicious, based on the metadata and the contextual information, wherein said determination as to whether the application is benign or malicious is made by: examining the metadata to determine whether the application is benign or malicious; if the application cannot be determined from the metadata to be benign or malicious, determining from the contextual information whether security of the system has been compromised; and if it is determined that security of the system has been compromised, utilizing a more aggressive detection capability to examine the metadata to determine whether the application is benign or malicious; and taking an action with respect to the application based on the information received from the server component. extracting metadata about the application; gathering contextual information concerning the system, wherein the contextual information includes recent infection history, applications running on the system, web sites visited, geographic location of the client, the Internet Protocol, IP, address of the client and a client identifier; transmitting the metadata and the contextual information to a server component; receiving a response from the server component relating to a determination as to whether the application is benign or malicious, based on the metadata and the contextual information, wherein said determination as to whether the application is benign or malicious is made by: examining the metadata to determine whether the application is benign or malicious; if the application cannot be determined from the metadata to be benign or malicious, determining from the contextual information whether security of the system has been compromised; and if it is determined that security of the system has been compromised, utilizing a more aggressive detection capability to examine the metadata to determine whether the application is benign or malicious; and examining the metadata to determine whether the application is benign or malicious; if the application cannot be determined from the metadata to be benign or malicious, determining from the contextual information whether security of the system has been compromised; and if it is determined that security of the system has been compromised, utilizing a more aggressive detection capability to examine the metadata to determine whether the application is benign or malicious; and taking an action with respect to the application based on the information received from the server component.