The ThreatQuotient for Zscaler Sandbox Operation runs and analyzes files in a virtual environment to detect malicious behaviour. It propagates a hash of malicious files to all Zscaler Enforcement Nodes (ZENs) throughout the cloud, effectively maintaining a real time blacklist so that it can prevent users anywhere in the world from downloading malicious files.