Patent ID: 8443445

Claim:
A method for scanning objects in a system, comprising: monitoring the system to detect an object event as the object event occurs, wherein the object event includes an operation performed on an object; determining a risk level for the object event, wherein determining a risk level includes using the nature of the object event to determine a risk level, wherein the risk level is determined based on the operation performed on the object, an object content, an object location, and a type of the object; scheduling a scan of the object associated with the object event according to the risk level, wherein the risk level falls within a risk range, wherein the risk range comprises one or more risk levels; performing the scheduled scan based on the risk range wherein the scheduled scan comprises a differential scan, wherein the differential scan has a scan interval that is a shorter interval than a collection period; performing additional scans of the object at the scan interval until the collection period is complete; and updating the risk level for the object event upon update to a scan engine.