A method of dealing with information on computer objects, the method comprising: at a first threat server, receiving data about a first computer object from a remote computer on which the object is stored and or processed, wherein the data about the first computer object includes data uniquely identifying the first computer object; determining, by the first threat server, whether the first computer object has been previously seen at the first threat server by comparing the data uniquely identifying the first computer object to a plurality of data uniquely identifying plural computer objects in a first database associated with the first threat server; if the first computer object has not been previously seen at the first threat server, receiving, by the first threat server, additional data about the first computer object from the remote computer and storing the data and the additional data about the first computer object in a second database (63a, 63b) associated with the first threat server; providing, by the first threat server, contents of the second database to at least one database (70, 71, 72) associated with a central server via a storage, wherein the contents comprise a signature of the first computer object, behavior information about the first computer object, and information about the remote computer; if the first computer object has been previously seen at the first threat server, increasing, by the first threat server, a count associated with a number of times that the first computer object has been seen at the first threat server, and providing the increased count to the central server; and receiving, at a second threat server, at least a portion of the contents of the at least one database associated with the central server, wherein the at least a portion of the contents of the least one database associated with the central server includes a subset of the data associated with the first computer object stored in the second database. at a first threat server, receiving data about a first computer object from a remote computer on which the object is stored and or processed, wherein the data about the first computer object includes data uniquely identifying the first computer object; determining, by the first threat server, whether the first computer object has been previously seen at the first threat server by comparing the data uniquely identifying the first computer object to a plurality of data uniquely identifying plural computer objects in a first database associated with the first threat server; if the first computer object has not been previously seen at the first threat server, receiving, by the first threat server, additional data about the first computer object from the remote computer and storing the data and the additional data about the first computer object in a second database (63a, 63b) associated with the first threat server; providing, by the first threat server, contents of the second database to at least one database (70, 71, 72) associated with a central server via a storage, wherein the contents comprise a signature of the first computer object, behavior information about the first computer object, and information about the remote computer; if the first computer object has been previously seen at the first threat server, increasing, by the first threat server, a count associated with a number of times that the first computer object has been seen at the first threat server, and providing the increased count to the central server; and receiving, at a second threat server, at least a portion of the contents of the at least one database associated with the central server, wherein the at least a portion of the contents of the least one database associated with the central server includes a subset of the data associated with the first computer object stored in the second database.