1. A method for determining an execution environment in a system having a plurality of execution environments including a first execution environment and a sandbox execution environment, the method comprising: receiving an executable application over a network connection; performing behavioral analysis, prior to execution of the executable application, on the executable application; determining the execution environment as a function of the behavioral analysis; if the behavioral analysis indicates sandboxed execution, starting execution of the executable application within the sandbox execution environment; if the behavioral analysis indicates other than sandboxed execution, starting execution of the executable application within the first execution environment; collecting behavioral characteristics of the executable application as it is executed; performing behavioral analysis on the collected behavioral characteristics to determine whether the execution location of the executable application should be changed.