Zero day threats are detected at gateway level and blocked from entering a network. A database containing signatures identifying malware is maintained at the gateway. Inbound network traffic is scanned using the signatures, and files containing malware are detected and blocked by the gateway. When a file is received by a given endpoint in the network, behavior based malware detection is used to determine whether the file contains a zero day threat. Whenever a file is adjudicated by an endpoint as containing a zero day threat, the endpoint generates an identifying signature, and transmits the signature to the gateway in real time. The gateway thus receives signatures identifying multiple zero day threats from multiple endpoints, and subsequently scans inbound network traffic for the received signatures. From that point, the gateway detects files containing the zero day threats, and blocks them from being routed to endpoints in the network.