1. A network security system comprising: a security network device to conduct an analysis on network traffic, the analysis on the network traffic includes detecting at least one suspicious object associated with the network traffic and determining an identifier associated with a suspicious object of the at least one suspicious object, the security network device further uploading both (i) the identifier associated with the suspicious object and (ii) ancillary data including information that identifies a return address for analysis results to a customer; and a detection cloud that comprises virtual machine provisioning logic and a scheduler being software that, when executed by hardware circuitry, customizes functionality of the detection cloud by provisioning one or more virtual machines by selecting a number of software profiles for use by the one or more virtual machines based, at least in part, on the suspicious object or at least a portion of the ancillary data, the one or more virtual machines to execute the suspicious object and determine whether the suspicious object is facilitating communications with a website that is associated with a malicious attack, and alert generation logic being software that, when executed by hardware circuitry and upon receiving a message from the virtual machine provisioning logic that a capacity for executing the at least one suspicious object by the detection cloud pursuant to a subscription level has been exceeded, generates a message to alert the customer to alter the execution capacity.