1. A method comprising: receiving, at a server in a distributed security system, a plurality of portions of a content item stored in a buffer, the buffer divided into a plurality of segments, wherein a size of the plurality of segments relative to one another is selected based on a data type of the content item by selecting increasing segment lengths for Web page traffic and decreasing segment lengths for streaming traffic minimizing degradations to end users of the distributed security system; computing a partial signature of the content item using the received portions of the content item in a most recently received segment and a partial signature computed for a preceding segment, wherein the partial signature is computed in a cumulative manner using the preceding segment; comparing the computed partial signature against a plurality of partial signatures associated with trustworthy content items based on spyware, malware, viruses, and threats; and if a matching partial signature associated with a trustworthy content item is found for the computed partial signature, allowing the plurality of portions of the content item to be transmitted to a device that requested the content item, wherein the plurality of portion are transmitted to the device as received by the server.