A computer program product embodied in a non-transitory computer readable medium that reduces computer file system access time associated with on-access scanning in a computing facility by receiving file access information describing a pattern of access of each accessed computer file, processing the file access information to generate a file access performance cost statistic for each of the accessed computer files, maintaining the file access performance cost statistic for each of the files, generating a file access performance cost mapping of the computing facility's file system relating to the computer files, generating a locality statistic from the performance cost map of a probability that the second computer file will be accessed near the time that the first computer file is accessed, and pre-scanning the second computer file when the probability is high that the second computer file will be accessed when that first computer file has been accessed.