What is sandbox detonation in email security?

Sandbox detonation executes suspicious attachments in isolated environments, observing behavior for malicious indicators. Sandboxes provide safe space to determine whether files are harmful before delivery.

Process: security gateway holds suspicious attachment, sandbox environment executes file, analysis observes behavior (network connections, file changes, process spawning), results determine delivery or blocking.

Limitations: sophisticated malware detects sandboxes, time constraints limit analysis depth, and some malware delays execution beyond sandbox timeouts. Sandboxing is valuable but not foolproof.