1. A method comprising: at a network infrastructure element: determining that an end-user platform seeks to download an executable program; executing the executable program to develop a corresponding model of the executable program representing operating system call-based behavior of the executable program; using the model of the executable program to vet the operating system call-based behavior of the executable program with respect to policies corresponding to the end-user platform; and permitting the end-user platform to download the executable program when the operating system call-based behavior of the executable program vets acceptably with respect to the policies.