A method for more efficiently scanning files for viruses includes determining a vulnerability date associated with a virus, wherein the vulnerability date is related to a release date of the virus. In certain embodiments, the vulnerability date is a user-tunable amount of time before or after the release date. The method further determines, on a storage system, which files that have been updated since the vulnerability date. These files are scanned for the virus in a first batch. The method further determines which files have not been updated since the vulnerability date. These files are scanned for the virus in a second batch. Because files in the first batch have been updated since the vulnerability date, scanning the first batch may be given priority over scanning the second batch. A corresponding system and computer program product are also disclosed.