Initially, organizations can set the NBMD device to block only files known to be malicious, while sending alerts for any files where there is an element of uncertainty, ensuring that enough resources are available to handle the additional workload this will generate.