1. A network security device comprising: one or more processors; and a non-transitory storage device having embodied therein instructions representing: a traffic file receive module configured to receive a traffic file containing therein network traffic of a private network that has been captured and stored; a network traffic protocol determination module configured to evaluate the received traffic file against traffic patterns associated with existence of one or more of a plurality of known network security threats within the private network; and a malware reporting module configured to report details regarding a network security threat of the plurality of known network security threats when the network traffic protocol determination module determines existence of the network security threat within the private network.