Zscaler – Cloud Sandbox

Zscaler Cloud Sandbox, licensed in its Advanced Cloud Sandbox tier, is a cloud-native sandbox delivered through the Zscaler platform that inspects files inline before they reach users. Suspicious files are checked with layered detection, including static and dynamic analysis, AI and machine learning models that can return instant verdicts, and detonation of files and secondary samples in virtual machines. Because inspection happens in the cloud with TLS and SSL decryption, it avoids the need for endpoint agents or firewall hooks. Zscaler describes an integration with its Zero Trust Browser so that users can safely view an original file while analysis completes, and files judged malicious can be flattened to PDF or disarmed. Administrators build policies by user role, location and file category, and they receive reports mapped to MITRE ATT&CK for audit and compliance use. An API accepts files out of band and exposes analysis data for SIEM, SOAR and EDR tools, which helps security operations teams investigate files from third parties or acquired entities. The platform was rated AAA by CyberRatings.org in an independent test that Zscaler cites for its sandbox and inline capabilities. It fits organizations that already use or plan to adopt Zscaler Internet Access and want sandboxing delivered from the same cloud, without managing appliances.