Watch what an attachment does, in a machine that can be thrown away

It adds evidence. It replaces nothing

Every check a protected domain already runs would keep running and keep scoring: signature scanning, file structure and type checks, macro and script inspection, archive handling, and reputation by hash. Those answer most attachments in milliseconds and cost nothing, and they are the reason a sandbox would be asked about so few files.

What they cannot answer is the file nobody has seen before. A hash lookup returns results from sandboxes that have already run that exact file, and returns nothing at all when none has — a hash lookup is not a detonation. For that file, the only remaining evidence is behavior, and behavior has to be observed.

A sandbox verdict would arrive in the same explainable score as every other stage, with a weight, and with the observations attached. There would be no separate override and no second scoring path: a message that was held would still be able to say which stage contributed what, which is the property this product is least willing to trade.

How it would work, end to end

1. An attachment arrives. The message is scanned as it is today. Nothing about this stage changes the handover, the MX record or the relay.
2. Policy selects it. Most attachments are never sent anywhere. A domain's policy decides which are candidates: file type, size ceiling, whether reputation already knew the file, how suspicious the rest of the message already looked, sender exclusions, and per-hour and per-day ceilings so that a spam run carrying one novel attachment cannot generate unbounded work.
3. It is analyzed in isolation. A candidate is opened in a disposable guest that exists to be destroyed afterwards, and is watched while it runs.
4. Findings come back. Process activity, file and registry changes, network connections, dropped files and matched signatures are normalized into one shape, recorded against the file's hash, and attached to the message as evidence.
5. The configured action happens. What that is belongs to the domain, not to us. A stage arrives off, and monitor-first when switched on: it records what enforcement would have done to real mail while changing nothing, and only a deliberate change to enforce lets it move the score.

The order is the safety argument. Policy first, then anything already held for that hash, then a lookup, and only last a file leaving the building — and that last step happens only where an administrator has explicitly allowed it.

Two ways to get an analysis host, and one of them does not exist yet

A third route already exists for anyone who does not want an analysis host at all: a provider account you hold. Behavioral results can be read from a third-party analysis service using your own account and your own credential, subject to that provider's terms. That is optional, off by default on every domain, and uploading a file to it is a disclosure — so it happens only where an administrator turned it on. See security and data handling for what leaves the building and when.

Building and managing a host

Installing a hypervisor, a sandbox controller, an isolated analysis network and a Windows guest onto a remote machine takes the better part of an hour and reboots the machine in the middle. Anything that long gets interrupted, so it is built as a resumable job rather than as a script:

• Preflight before anything is changed, so a machine that cannot support the work is refused at the start rather than halfway through.
• Every step probes for its own outcome first, so running the job again is a legitimate recovery instead of the thing that breaks the host.
• Progress is state, not log lines. A resumed job restarts at the first step not recorded complete — which is what makes the reboot in the middle survivable.
• A machine already doing something else is left alone. A host carrying other virtual machines, or another sandbox, stops the job rather than being taken over.
• Nothing is exposed beyond the management address — not the database, not the hypervisor, not a guest console, not the sandbox web interface — and firewall rules are never applied in an order that could drop the operator's own session.
• A host is not called ready because an install finished. Containment and end-to-end validation are separate steps and both fail closed.
• Bootstrap credentials expire. A provisioning password is useful for one install and is a live shell credential for ever after, so it is stored encrypted, given an expiry, erased when the job reaches a terminal state, and redacted out of the job log.

Written, reviewed, and never run against a real machine. No analysis guest exists on this platform, and neither containment validation nor end-to-end validation has been exercised live. Beta participants would be building the first one with us, and should read that sentence as the offer rather than as a disclaimer.

What it would not do, stated before you ask

• "No malicious behavior observed" is not proof a file is safe. It means nothing malicious happened in that guest, in that time, with those applications installed. Malware that waits, checks whether it is being watched, or needs a target the guest does not resemble will sit there and look boring. Treat a clean result as one piece of evidence, never as a clearance.
• Supported file types depend on the guest. A file can only be opened by an application that is installed. A guest without a particular office suite, reader or runtime cannot meaningfully run files that need it, and the list of what is worth sending follows what you built, not a marketing table.
• Some files cannot be fully analyzed at all. An archive that needs a password, a document that needs a login, a payload that only unpacks after a human clicks through two dialogs — automated analysis reaches a wall and the honest answer is unknown.
• It takes time, and mail does not. Analysis is minutes; delivery is milliseconds. Nothing waits on a verdict at the smtp handover, so what happens to a message while its attachment is still being looked at is a policy choice with real trade-offs on both sides — and a verdict that lands late acts on delivered mail instead of pretending it was in time.
• A host you operate costs real money and real licenses. Compute, storage, and legitimate Windows and application licenses for the guest are yours to hold. We will not tell you that malware analysis is free, and we will not ship you a guest built from software we have no right to distribute.
• It sanitizes nothing. Sandboxing observes a file and reports on it. Rewriting an attachment into a safer form is a different capability with a different trade-off, listed separately in features, and neither one implies the other.
• It is not an antivirus replacement. It runs last, on the few files everything cheaper could not answer.