1. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method comprising: receiving a binary executable comprising obfuscated malware on a host device; recording incident data indicating a time when the binary executable was received and identifying processes operating on the host device at the time; analyzing the binary executable via a scalable plurality of execution environments, including one or more non-virtual execution environments and one or more virtual execution environments, to execute a plurality of malware analysis modules and to generate runtime data based on execution of the obfuscated malware and deobfuscation data attributable to the binary executable, wherein the deobfuscation data is generated based on an identification of a simplified version of the obfuscated malware; storing the runtime data and deobfuscation data attributable to the binary executable in a shared database; storing the incident data in a private, non-shared database other than the shared database, wherein, of the shared database and the private, non-shared database, the incident data is available only via the private, non-shared database; and increasing the scalable plurality of execution environments to execute the plurality of malware analysis modules, the increasing based, at least in part, on the generated runtime data.