1. A method comprising: receiving an object at an appliance coupled to a network, the object directed to an endpoint on the network; determining whether a malware detection analysis of the object requires extensive processing at the appliance; in response to determining that the malware detection analysis requires extensive processing: initiating delay of execution of the object at the endpoint; and performing the malware detection analysis at the appliance, the malware detection analysis spawning a virtual machine to encapsulate a process including the object, the virtual machine instrumented to monitor operation of the process as the process attempts to access first and second kernel resources to detect whether the process includes malware.