THREAT‑WATCH
Glossary
Sandboxing
Running an untrusted file or program in an isolated environment to observe its behavior without risking the real system.
Sandboxing lets security tools detonate a suspicious email attachment or download in a disposable, isolated virtual environment first, watching what it actually does (what files it creates, what connections it makes) before deciding whether to allow it on real systems. It's particularly effective against malware designed to evade signature-based detection, since behavior is harder to disguise than file content.