1. A threat protection network for detecting and analyzing suspicious files in real-time, comprising: at least one client computer connected to a network; a server that stores threat definition data and is connected to the network; an expert system in communication with the server; at least one test computer connected to the expert system; wherein the client computer is configured to identify a suspicious file on the client computer; wherein the client computer is configured to automatically notify the server of the suspicious file; wherein the server is configured to send the suspicious file to the expert system; wherein the expert system is configured to determine whether the suspicious file is an actual threat by exposing the at least one test computer to the suspicious file and analyzing the behavior of the suspicious file on the at least one test computer; and wherein the expert system is configured to isolate the expert system and the at least one test computer from the network prior to exposing the at least one test computer to the suspicious file by preventing any data from being sent to the network during the analysis of the behavior of the suspicious file on the at least one test computer.