Is your company ready for threats no one has seen before?
Traditional antivirus solutions work by comparing files against a database of known viruses. But what happens when the attacker uses completely new malware, specifically designed to evade those defenses? That is where cloud sandbox analysis makes the difference.
In this article, we explain what sandboxing is, how the ESET LiveGuard Advanced solution works, and why it is an essential layer of protection for any company handling sensitive data or working with corporate email.
What is a Sandbox in Cybersecurity?
A sandbox (literally, “sandbox”) is a virtual environment completely isolated from the company’s real system. Its function is to execute suspicious files or programs and observe their behavior without causing any harm to production equipment.
Imagine it as a digital quarantine room: the file enters, is analyzed in depth, and only if deemed safe is it allowed to reach the recipient or the system.
The cloud sandbox takes this concept a step further: instead of performing the analysis on a local machine (which consumes resources and can be compromised), it is carried out on high-capacity remote servers, leveraging the cloud’s computational power to run multiple tests simultaneously.
ESET LiveGuard Advanced: Cloud Sandbox for Businesses
ESET LiveGuard Advanced is ESET’s cloud sandbox analysis solution, specifically designed for enterprise environments. When a file arrives at an endpoint, server, or email mailbox and raises doubts about its safety, LiveGuard automatically sends it to an isolated environment in the cloud for analysis.
How does the step-by-step analysis work?
- Detection of the suspicious file: The ESET agent installed on the endpoint or mail server identifies a file that cannot be definitively classified as safe or malicious.
- Sending to the cloud: The file is securely uploaded to the ESET LiveGuard Advanced servers.
- Four-layer analysis:
- Unpacking and static analysis with artificial intelligence
- Dynamic analysis (execution in an isolated environment)
- Comparison with global threat intelligence sources
- Verification with real-time reputation data
- Automatic verdict: The system determines whether the file is safe, malicious, or unknown and acts accordingly.
- Proactive protection: While the analysis is ongoing (most samples are processed in less than 5 minutes), the execution of the file is blocked to prevent any risk.
- Detailed report: The entire process is recorded in the ESET PROTECT console, with granular reports that the IT manager can consult at any time.
What threats does the Cloud Sandbox protect you against?
1. Ransomware via corporate email
The most common attack vector in businesses remains email. An employee receives an apparently legitimate attachment (an invoice, a quote, a contract) that actually contains ransomware. If that file reaches the mailbox and the user opens it before the antivirus detects it, the infection can spread in minutes.
ESET LiveGuard Advanced analyzes email attachments in the cloud before they reach the user, blocking the threat at its source.
2. Zero-Day Threats
Zero-day threats are attacks that exploit unknown vulnerabilities for which no detection signature yet exists. Traditional antivirus solutions are blind to them. The sandbox, on the other hand, does not look for signatures: it observes behavior. If the file attempts to encrypt files, connect to external servers, or modify the system registry, the sandbox detects it regardless of whether that malware has been seen before or not.
3. Targeted attacks and data leakage
Companies with valuable information (customer data, intellectual property, financial data) are targets for targeted attacks (APT) using custom malware designed to evade known defenses. The cloud sandbox analysis by ESET analyzes behavior in depth, detecting even these sophisticated threats.
Which ESET products is ESET LiveGuard Advanced compatible with?
One of the major advantages of LiveGuard Advanced is its native integration with the ESET ecosystem. It works with:
- ESET Endpoint Security / Antivirus for Windows — Protection on employee endpoints
- ESET File Security for Windows Server and Linux — Protection on file servers
- ESET Mail Security for Microsoft Exchange — Email attachment analysis on the server
- ESET Cloud Office Security — Protection for Microsoft 365, SharePoint, OneDrive, and Teams
This comprehensive coverage means that all threat entry vectors in your company are protected by the same sandbox analysis engine.
In which ESET PROTECT plans is it included?
ESET LiveGuard Advanced is included starting from the ESET PROTECT Advanced plan. Here is a summary of availability:
| ESET PROTECT Plan | LiveGuard Advanced included |
|---|---|
| ESET PROTECT Entry | ❌ Not included |
| ESET PROTECT Advanced | ✅ Included (from 5 devices) |
| ESET PROTECT Complete | ✅ Included (from 5 devices) |
| ESET PROTECT Elite | ✅ Included (from 25 devices) |
If you currently have ESET PROTECT Entry and want to add sandbox protection, you can upgrade to ESET PROTECT Advanced. As authorized ESET distributors in Spain, we advise you on the migration at no additional cost.
Advantages of Cloud Sandbox over Local Sandbox
| Feature | Local Sandbox | Cloud Sandbox (LiveGuard) |
|---|---|---|
| Equipment resource consumption | High | None |
| Analysis speed | Variable | < 5 minutes in most cases |
| Scaling for multiple samples | Limited | Unlimited (cloud) |
| Detection updates | Manual/periodic | Real-time |
| Remote operation | Requires VPN | Independent of location |
| Infrastructure maintenance | Customer’s responsibility | Managed by ESET |
For companies with employees working remotely or in a hybrid model, the cloud sandbox is especially valuable: it works regardless of where the employee is, without needing to connect to the corporate network.
Visibility and control from the ESET PROTECT console
One of the most valued aspects by IT managers is the total visibility offered by ESET LiveGuard Advanced. From the ESET PROTECT console you can:
- View the complete history of samples analyzed in the cloud
- Consult the verdict and the reasoning behind each analysis
- Access granular reports with the observed behavior during the analysis
- Configure which file types are automatically sent to the sandbox
- Set policies by user group or device
This traceability is especially important for companies that need to comply with regulations such as ENS (National Security Scheme) or GDPR, where being able to demonstrate that active measures were taken against threats is a requirement.
Is the Cloud Sandbox suitable for my company?
Cloud sandbox analysis is not just for large corporations. It is especially recommended for SMEs that:
- Handle sensitive customer data (law firms, clinics, accounting offices, consultancies)
- Regularly receive email attachments from external suppliers or clients
- Have employees in remote work or hybrid work
- Have suffered a ransomware incident previously
- Need to comply with security and audit requirements (ISO 27001, ENS, GDPR)
- Manage file servers or Microsoft Exchange mail servers
Frequently Asked Questions about ESET’s Cloud Sandbox
Are files sent to the ESET sandbox confidential?
ESET treats files sent to the sandbox with strict privacy protocols. Samples are used solely for security analysis and are not shared with third parties. ESET complies with European GDPR in data processing.
What happens if the analysis determines that a file is malicious?
The file is automatically blocked and does not reach the recipient or the system. The threat information is shared in real-time with ESET’s global protection network (LiveGrid), protecting other ESET users around the world as well.
How long does the sandbox analysis take?
The vast majority of samples are analyzed in less than 5 minutes. During that time, the file is blocked preventively, so the user cannot execute it accidentally.
Do I need additional hardware to use ESET LiveGuard Advanced?
No. As a cloud service, it does not require any additional server or hardware in your company. You only need a valid subscription to ESET PROTECT Advanced or higher, and the functionality is activated directly from the ESET PROTECT console.
Can I add ESET LiveGuard Advanced to my current plan?
If you have ESET PROTECT Entry, you will need to upgrade to ESET PROTECT Advanced. If you already have ESET PROTECT Advanced or Complete, LiveGuard Advanced is already included in your license. Contact us to review your current subscription and manage the upgrade.
Conclusion: Cloud Sandbox as an Essential Layer of Protection
In an environment where threats evolve faster than antivirus signatures, relying solely on signature-based detection is an unacceptable risk for any company. The ESET LiveGuard Advanced cloud sandbox analysis adds a proactive layer of protection that analyzes the actual behavior of suspicious files before they can cause harm.
Available in the ESET PROTECT Advanced and ESET PROTECT Complete plans, it is the ideal solution for SMEs that want enterprise-level protection without the need for additional infrastructure.
Want to know if your company is protected with cloud sandbox? Contact our team and we will perform a free review of your current security configuration.
Want to see prices or buy?
View ESET PROTECT Advanced View ESET PROTECT Complete
