What is a sandbox in security?

A sandbox is an isolated environment where a suspicious file or link can be opened safely to see what it does, without risking real systems. Email security services often send attachments to a sandbox before delivering them: if the file tries to download more code, change system settings or contact strange servers, it is blocked. Sandboxes catch a lot, but malware authors know about them, and some malware waits, checks whether it is being watched or only activates on a real user's machine. That is why sandboxing is one layer among several, alongside endpoint protection and watching the network.

← All 69 questions on What is…? Network and security termsAll topics