I would like the ability to have the actual malware samples that were detected on an Endpoint accessible for post breach incident response and mitigation. Ideally once a file is detetced it will be moved or uploaded to Sophos Central and an Administrator can download the file in a ZIP. If this is not possible instead of deleting the file I would like it encrypted and moved to ProgramData so it can be collected after by Incident responders.