1. A method for use with a server and a group of associated hosts, comprising: storing in the server meta-information file states relating to files seen on the hosts, the meta-information including a signature of the content of the files; storing in the server for each signature, an initial time that the file is first seen on the host, including for at least some files, a time when the file is first received, and further storing a file state indicating whether or not certain file operations can be performed, and if file operations are allowed to be performed, with what conditions certain file operations can be performed by hosts on the file, wherein the states include banned, allowed, and pending, wherein a pending state allows file operations subject to security restrictions and further monitoring; at defined periods related to the initial time, performing at least one security analysis of the file, or of the signature of the file contents; and altering the file state based on the security analysis and providing updated information related to the altered file state to the hosts.