FortiSandbox Cloud: Features & Benefits

• Delivered as a SaaS/PaaS sandbox — no on-premises hardware or VM lifecycle to manage
• Scales dynamically to handle varying file/URL submission loads across global, distributed environments
• Supports integration with multiple Fortinet products (firewall, mail, web app, endpoint) for broad coverage

• Static code scanning via machine learning detects suspicious files even before execution
• Dynamic behavioural analysis within sandbox VMs exposes evasive threats — ransomware, zero-day malware, file-less attacks, callback/C&C activity, embedded document exploits
• Continuous updates and integration with threat-intelligence feeds (FortiGuard) help detect emerging malware and exploit patterns

• Supports file submission from firewall, email gateway, web application firewall, endpoints or manual upload — enabling unified detection across network, email, web and endpoint vectors
• Inline blocking or quarantine of suspicious files/URLs until verdict — preventing delivery of malicious payloads to users or systems
• Automates threat response, reducing manual SOC workload and accelerating incident handling

• Detailed analysis reports with behavioural logs, packet captures, screenshots, and indicators of compromise (IOCs) to support forensic investigation and malware research
• Mapping of detected techniques to frameworks such as MITRE ATT&CK — helping security teams contextualise threats and respond appropriately
• Centralised threat intelligence sharing across your security fabric and optionally across the global sandbox community to improve detection accuracy and collective defence.