Sending the URL of a scanned file to GTI to determine its source reputation (GTI) is critical to the GAM engine. This action allows the engine to establish a context and accurately classify the file.

If the GAM engine can’t use the GTI detection capabilities, the observed detection rate is the same as older, pre-2014 GAM engines. This inability to use the GTI detection capabilities causes missed detections, or a higher than expected rate of false positives.

Some of the information the GAM engine retrieves from the URL lookup, such as URL categories or Geolocation, is available in the local URL filter database. But, much of the information, such as URL web reputation, can be retrieved only from the GTI cloud.