Joe Security – Joe Sandbox

Joe Sandbox is a deep malware and phishing analysis platform from Joe Security, a privately owned Swiss company founded in 2011. It detonates files, URLs, emails and installers in a controlled environment, records behavior at the operating system and API level, and compiles the activity into detailed reports with indicators of compromise, MITRE ATT&CK mapping and downloadable artifacts such as dropped files, memory dumps and PCAPs. Analysis covers Windows, macOS and Linux, including native Apple Silicon and bare-metal machines, while a hypervisor-based inspection layer is designed to keep monitoring hidden from evasive samples. Hybrid code analysis and execution graph analysis combine static and dynamic techniques, and generative AI adds phishing detection, summaries and reasoning over emails and web pages. Analysts can interact live with running samples, script user behavior with cookbooks and add their own YARA rules. The service is sold as Joe Sandbox Cloud in Basic, Light, Pro and Enterprise tiers, with a REST API for SOAR, SIEM and EDR integration, SSO and optional single-tenant architecture, and it sits alongside Joe Lab and the Joe Reverser agentic reverse-engineering tool. Joe Security states that analyses in its paid tiers stay private and are not shared with third parties, and that the company is ISO 27001 certified with European data centers.