The global scan cache stores the clean scan results. The on-access scanner and on-demand scanner can check the cache to avoid scanning known clean files and improve performance.
The Threat Prevention global scan cache is flushed when:
The On-Access Scan or On-Demand Scan configuration changes.
An Extra.DAT file is loaded.
The daily AMCore Content file includes an updated Trust DAT.
Trust DATs are released every 1–2 weeks, as needed for new certificates.
The system reboots in safe mode.
An individual object is flushed from the cache when:
The object has changed on the disk.
The object expires.
By default, items in the cache are flushed after 5 days, if the entire cache hasn't been flushed in that time. The expiration time for an item might differ from the default if the cache is full. Recently accessed cache items are retained; older items expire and are removed.
If the process is signed by a trusted certificate, the signing certificate is cached and remains in the cache after the system reboots. The scanner is less likely to scan files accessed by processes that are signed by a cached trusted certificate, resulting in scan avoidance and improved performance.