1. A computer-implemented method for detecting malicious software (malware) on an endpoint, comprising: detecting arrival of a file at the endpoint from a host; observing network traffic at the endpoint to observe a network identifier of the host from which the file arrived; querying a security server as to whether the network identifier is associated with a suspicious host; receiving a response to the query from the security server, the response indicating whether the network identifier is associated with a suspicious host; responsive to receiving an indication that the network identifier is associated with a suspicious host, applying a first set of heuristics to the file to determine whether the file is malware; and responsive to receiving an indication that the network identifier is not associated with a suspicious host, applying a second set of heuristics less resource-intensive than the first set of heuristics to the file to determine whether the file is malware.