1. A method of detecting potentially malicious content, comprising: identifying the content for inspection; upon occurrence of an application processing the content on a processor, tracing the activity of the processor in order to form trace data, by using features of the processor; upon occurrence of an exception, transferring control to an analyzer that detects suspicious activity according to the trace data based on a context of the exception.