Hack the Route Start free Open app Detection and response
Sandboxing
Running untrusted code or attackers in an isolated environment to observe behaviour without real risk.
A sandbox is a contained, instrumented environment where suspect code is detonated, or an attacker is let to roam, so defenders learn what it does without endangering real systems. It shares the honeypot's logic — isolate and observe — and feeds the indicators it uncovers back into detection. The isolation must be real: anything that escapes the sandbox defeats its purpose.