Context-dependent timeout for remote security services

A computer program product encoded on one or more non-transitory computer storage media, the computer program product comprising instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:

• intercepting a network request from a process executing on an endpoint;
• applying a recognition engine locally on the endpoint to estimate a risk associated with the network request;
• transmitting a lookup request for the network request from the endpoint to a remote threat management facility;
• determining a timeout for a response from the remote threat management facility to the lookup request based on the risk, the timeout providing a window of limited duration for receiving the response at the endpoint;
• when the response is received within the window, processing the network request according to the response from the remote threat management facility;
• and
• when the response is not received within the window, processing the network request using a default local rule on the endpoint.

A system comprising:

• an endpoint associated with an enterprise network, the endpoint including a computing device comprising a memory and a processor;
• an endpoint security agent executing on the processor based on instructions in the memory, the endpoint security agent including a recognition engine to estimate a risk associated with a network request, and the endpoint security agent configured to apply the recognition engine locally on the endpoint to estimate the risk associated with the network request, to transmit a lookup request for the network request from the endpoint to a threat management facility for the enterprise network, to determine a timeout for a response from the threat management facility to the lookup request based on the risk determined by the recognition engine, the timeout providing a window of limited duration for receiving the response at the endpoint, when the response is received within the window provided by the timeout, to process the network request according to the response from the threat management facility and, when the response is not received within the window, to process the network request using a default local rule on the endpoint;
• and
• the threat management facility for the enterprise network, the threat management facility coupled in a communicating relationship with the endpoint, the threat management facility configured to evaluate a reputation of a resource associated with the network request.