Palo Alto, and probably others firewalls will offer it too, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks could be related with this approach. Some problems that I thought:
Privacy: Which kind of data is sent to the cloud based anti-malware solution? There is any kind of risk associated or any kind of way to guarantee that has no information leak?
If somebody/group DDoS the cloud provider. Does it affect my firewall anyhow?
If its a targeted attack and the cloud detect the attack. As it isn't streamed, can be that it will be too late when it detects the attack?