osquery's virtual tables dynamically fetch data only when a query is executed rather than pre-caching it, so the cost of a full table scan represents real system call overhead.