What actually happened or you saw:
Everything works when online [cloud obviously].
What you wanted to happen or see:
Ability do download all protection database [malware, recognizers] which are dormant, and kick in when loss of internet connectivity is detected. So, while online, use cloud as default. When offline, switch to database stored locally until internet is detected again. Also, have periodic signatures download to stay current [every hour, day, etc…]. Also, have ability to import databases from USB/CD.
Why you think it is desirable:
For people who work in poor internet environment, or could stay offline for months at the time. Even though Containment would [should] do the job while offline, a confirmation from the virus scanner that the file is indeed malicious would be beneficial.
Any other information, screenshots etc:
I work at sea months at the time and the only time internet is available is when in port. Crew likes to spread malware with USB’s taken from internet cafe’s while in port.