A method for updating software programs on a computer, the method comprising: detecting an attempt by an update process to execute on the computer, wherein during execution, the update process downloads an update object for a software program; retrieving a policy containing at least an authorized category of software programs for the computer, wherein the authorized category includes software programs that were checked for being clean of malware allowed to execute and update on the computer; determining from the policy whether the detected update process is associated with the authorized category of software programs; when the update process is associated with the authorized category of software programs, (i) designating the update process as a trusted process, (ii) allowing the trusted update process to download on the computer the update object for the software program, (iii) and designating the update object of the software program as a trusted object; downloading by the trusted update process the trusted update object on the computer, wherein the trusted update object contains a software program update; detecting an attempt by an installation process to execute on the computer, wherein during execution, the installation process installs the trusted update object; determining from the policy whether the detected installation process is a child process of the trusted update process and associated with the authorized category of software programs; and when the installation process is the child process of the trusted update process and associated with the authorized category of software programs, designating the installation process as trusted and allowing the trusted installation process to install the trusted update object on the computer. detecting an attempt by an update process to execute on the computer, wherein during execution, the update process downloads an update object for a software program; retrieving a policy containing at least an authorized category of software programs for the computer, wherein the authorized category includes software programs that were checked for being clean of malware allowed to execute and update on the computer; determining from the policy whether the detected update process is associated with the authorized category of software programs; when the update process is associated with the authorized category of software programs, (i) designating the update process as a trusted process, (ii) allowing the trusted update process to download on the computer the update object for the software program, (iii) and designating the update object of the software program as a trusted object; downloading by the trusted update process the trusted update object on the computer, wherein the trusted update object contains a software program update; detecting an attempt by an installation process to execute on the computer, wherein during execution, the installation process installs the trusted update object; determining from the policy whether the detected installation process is a child process of the trusted update process and associated with the authorized category of software programs; and when the installation process is the child process of the trusted update process and associated with the authorized category of software programs, designating the installation process as trusted and allowing the trusted installation process to install the trusted update object on the computer.