Zero-day protection is powered by SophosLabs Intelix™, a cloud service that combines machine learning, sandboxing, and research to detect known and unknown threats by analyzing suspicious downloads and email attachments. Sophos Firewall sends new files to SophosLabs Intelix for zero-day protection analysis when they enter your network. Intelix uses layers of analytics to determine the level of risk posed to your network by each file. In addition to blocking risky files, zero-day protection also provides detailed reports of the analysis performed to help you understand the risk.