1. A data processing apparatus, comprising: at least one processor; a first network interface coupled to the processor and configured to be coupled to a protected network; a second network interface coupled to the processor and configured to be coupled to an external network; a core hypertext transfer protocol (HTTP) proxy coupled to the processor and coupled to a content cache, wherein the HTTP proxy is configured to receive an HTTP request from a client computer in the protected network, send the request to a network resource in the external network on behalf of the client computer, and receive an HTTP response from the network resource on behalf of the client computer; a plurality of spyware scanning engines (SSEs), wherein each of the SSEs is coupled to stored content signatures, and wherein each of the SSEs is configured to detect a particular kind of malicious software in the HTTP response; logic comprising one or more sequences of instructions which when executed cause the at least one processor to perform: scanning the HTTP response and determining two or more types of content in the HTTP response; based on the types of content in the HTTP response, selecting two or more of the SSEs for use in further evaluation of the HTTP response; providing a reference to the HTTP response to the selected two or more SSEs.