1. A method comprising: at a network security device connected between a network and an endpoint device that is configured to host a client application, the client application configured to communicate with the network through the network security device using an in-band request-response protocol to which the network security device and the endpoint device add context headers including context information about the client application: receiving from the client application a request that is destined for the network and that seeks a response from the network, the request having a context header added thereto including context information about the client application; removing the context header from the request; determining whether the client application or a file accessed by the client application has a suspicious nature based on the context information; if the suspicious nature is determined: blocking the request from the network; sending to the client application a response indicating the blocking and having added thereto a context header including a query for further information useable to confirm the suspicious nature, and a request identifier associated with the query; receiving from the endpoint device a second request destined for the network and having added thereto a context header that includes the further information and the request identifier to associate the context header in the second request with the query in the response; and confirming the suspicious nature based on the further information; and if the suspicious nature is not determined, forwarding the request without the context header to the network.