Today’s appliance-based sandboxing solutions are expensive and, therefore, typically installed only in the data center. When users leave the network, they become exposed to new threats because sandbox protection can’t follow them.

Traditional sandboxes usually operate out of line, allowing traffic through while inspecting suspicious files in TAP mode. If a threat is detected in the sandbox, it sends alerts, but they can arrive too late. Traditional sandboxes also lack the ability to fully inspect SSL traffic due to hardware limitations—and many malware authors are exploiting those limitations to distribute their malicious payloads.

In order to provide sandbox protection, organizations have bolted sandboxing solutions onto their existing security stacks. It helps, but achieving a fully integrated threat platform across multiple products is nearly impossible.