Analyzing file behavior in a sandbox requires malware analysis and operating system expertise on the part of security analysts. Many hail sandboxing as the best way to detect hidden and previously unknown threats in file attachments and web links.