A system and method for using file system events to trigger a security scan. A file system watches all writable directory paths for defined file system events on files in the watched paths. Upon occurrence of a watched event, the file is scanned using known security methods. A data structure stores events and can be used to update and track events. Cookies can be used to correlate MOVE events. A timer can be used to avoid repetitive scanning after discrete WRITE events.