1. A threat protection network for detecting potential threats, comprising: at least one client computer connected to a network; a server that stores threat definition data and is connected to the network; an expert system in communication with the server; wherein the client computer is configured to refer potential threats to the server; wherein the server is configured to refer to the expert system any potential threat forwarded by a client computer that is not identified in the threat definition data; wherein the expert system is configured to determine whether the potential threat is an actual threat by exposing at least one test computer to the potential threat and observing the behavior of the test computer.