Determining a security status of potentially malicious files

Abstract

A server system that includes one or more processors and memory receives, from a client, metadata for a plurality of suspicious files for which the client was unable to conclusively determine a security status. The server system also analyzes the metadata using threat-identification information to identify potentially malicious files and requests authorization to receive the potentially malicious files from the client. In response to the request, upon authorization for the server system to receive the potentially malicious files, the server system automatically receives one or more potentially malicious files from the client that were authorized based on a confidentiality level of the potentially malicious files. After receiving the one or more potentially malicious files, the server system analyzes the potentially malicious files using threat-identification information available at the server system and provides, to the client, an indication of the security status of the one or more potentially malicious files.