# What is a sandbox in security?

A sandbox is an isolated environment where a suspicious file or link can be opened safely to see what it does, without risking real systems. Email security services often send attachments to a sandbox before delivering them: if the file tries to download more code, change system settings or contact strange servers, it is blocked. Sandboxes catch a lot, but malware authors know about them, and some malware waits, checks whether it is being watched or only activates on a real user's machine. That is why sandboxing is one layer among several, alongside endpoint protection and watching the network.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-is-a-sandbox-in-security

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What are allowlists and denylists?](https://netsenx.com/en/faq/what-are-allowlists-and-denylists)
- [What are IDS and IPS?](https://netsenx.com/en/faq/what-are-ids-and-ips)
- [What is SOAR?](https://netsenx.com/en/faq/what-is-soar)
- [What is DLP (data loss prevention)?](https://netsenx.com/en/faq/what-is-dlp-data-loss-prevention)
- [What is an audit log?](https://netsenx.com/en/faq/what-is-an-audit-log)