A file was seen on several endpoints last week and judged clean when it arrived. Today new threat intelligence shows that the same file is malicious. How does Cisco Secure Endpoint handle the hosts that already received it?
Select an answer to reveal the explanation.
Short Explanation
It's like a product recall: the store remembers who bought the bad batch and calls each of them back. Secure Endpoint remembers where every file went, so when the verdict flips, you get those exact hosts flagged. The trap is thinking a "clean" verdict is forever.
Full Explanation
Cisco Secure Endpoint records where each file was seen and continues to evaluate file dispositions in the cloud after the initial decision. When new intelligence changes a file from clean or unknown to malicious, the service issues a retrospective detection for every host that had the file, and, depending on policy, the connector can quarantine it retroactively. Combined with trajectory data, this shows which hosts received and executed the file and what it did, turning a point-in-time verdict into continuous analysis. Treating the first verdict as final is exactly the gap retrospective security closes; malware is often unknown at first contact and recognized only later. Dispositions are not limited to scheduled scans: the cloud lookup and the record of file sightings make it possible to act on a changed verdict without rescanning every disk. Automatic reimaging is not how the product responds; reimaging is an incident-response decision made after scoping, and a changed verdict does not prove that every host was fully compromised. Exam caveat: retrospective detection depends on the file having been seen and recorded while the connector was active. Operational check: open the retrospective event, use file trajectory to list affected hosts, confirm quarantine status on each, and investigate any host where the file executed.