A security device for processing a plurality of network flows, comprising: a first packet processor and a second packet processor each configured to receive incoming data packets associated with one or more network flows, at least one of the first and second packet processors being assigned as an owner of one or more network flows, and each packet processor processing data packets associated with network flows for which it is the assigned owner and each network flow being assigned to only one owner packet processor, each owner packet processor processing data packets associated with a network flow to enforce a security policy; a packet processing manager configured to assign ownership of network flows to the first or second packet processor, the packet processing manager comprising a global flow table containing entries mapping network flows to packet processor ownership assignments; and a switching fabric in communication with the first and second packet processors and the packet processing manager, wherein in response to the packet processing manager receiving a first data packet belonging to a first network flow for which no entry for the first network flow is found in the global flow table, the packet processing manager assigns the first packet processor as an owner of the first network flow, and informs the first packet processor of the ownership assignment, and the second packet processor learns of ownership assignments of network flows from the packet processing manager as data packets are being received and the second packet processor forwards received data packets belonging to the first network flow to the first packet processor for processing. a first packet processor and a second packet processor each configured to receive incoming data packets associated with one or more network flows, at least one of the first and second packet processors being assigned as an owner of one or more network flows, and each packet processor processing data packets associated with network flows for which it is the assigned owner and each network flow being assigned to only one owner packet processor, each owner packet processor processing data packets associated with a network flow to enforce a security policy; a packet processing manager configured to assign ownership of network flows to the first or second packet processor, the packet processing manager comprising a global flow table containing entries mapping network flows to packet processor ownership assignments; and a switching fabric in communication with the first and second packet processors and the packet processing manager, wherein in response to the packet processing manager receiving a first data packet belonging to a first network flow for which no entry for the first network flow is found in the global flow table, the packet processing manager assigns the first packet processor as an owner of the first network flow, and informs the first packet processor of the ownership assignment, and the second packet processor learns of ownership assignments of network flows from the packet processing manager as data packets are being received and the second packet processor forwards received data packets belonging to the first network flow to the first packet processor for processing.