Why modern email threats outrun signatures, and how AI-powered detonation (e.g., FortiSandbox) stops unknown payloads and trackers
Email is still the #1 entry point for breaches but the way attackers use it has changed.
In 2026, the biggest problem isn’t that email security is “bad.” It’s that many organisations still rely too heavily on signature-based detection (static IOC matching, known hashes, known patterns, blocklists). Those controls still matter but they no longer provide reliable protection against the attacks that actually land today.
Attackers now build campaigns designed to be:
- unique per target (polymorphic content),
- delivered via trusted platforms (cloud links, shared docs),
- hidden inside modern file formats (HTML smuggling, PDFs with embedded lures),
- and unknown at first sight (new droppers, new loaders, new “trackers” and tooling).
That is why sandboxing has moved from “nice to have” to core email security.
Why signatures are losing the race
Signature-based filtering works best when the threat is already known:
- known malware families
- known URL infrastructure
- known attachment hashes
- known phishing templates
But 2025–2026 email tradecraft is optimized to avoid exactly that.
1) Polymorphic emails at scale
Attackers can generate endless variations of the same lure: different text, different structure, different sender style, different attachment wrapper making static signatures far less reliable. Security vendors increasingly highlight how AI-driven variation undermines rule/signature approaches. (Abnormal AI)
2) HTML smuggling and “clean-looking” attachments
HTML smuggling surged in real-world phishing telemetry, because it can deliver payloads or redirect flows without classic “malware attachment” patterns. One 2025 phishing trends report observed a large increase in HTML smuggling during late 2024–early 2025. (knowbe4.com)
3) QR-code phishing and image-based lures
QR phishing became mainstream because it bypasses simple URL scanning when the link is embedded in an image (and requires additional analysis like computer vision + link detonation). (TitanHQ)
4) URLs over attachments (and remote tooling)
Threat reporting shows a major shift toward URL-based campaigns (credential phishing, RMM/RAT tooling, staged payload delivery). That’s important because URL threats are often “clean” at delivery time and become malicious later. (IT Pro)
Bottom line: signatures aren’t “dead,” but signatures alone don’t stop unknowns especially when the first-stage email contains nothing obviously malicious.
What sandboxing actually does (in plain terms)
A sandbox doesn’t ask: “Have we seen this before?”
It asks: “What does this do when executed?”
Sandboxing detonates suspicious content in an isolated environment and looks for:
- exploit behavior
- process injection / unusual child processes
- credential theft patterns
- C2 beaconing and suspicious network calls
- file/system changes
- evasion techniques
This is why sandboxing is effective against unknown trackers and droppers the stuff that has no signature yet, or changes per recipient.
Why 2026 is the “sandboxing era” for email
Because modern email threats are built around delayed or conditional execution:
- Links that redirect based on geolocation, user agent, or time
- Attachments that only unpack after multiple steps
- Payloads that appear after a user clicks “Enable content” / “View document”
- Stagers that pull the real payload from the internet
Sandboxing doesn’t rely on static indicators. It focuses on behavior.
What AI-powered sandboxing adds (beyond traditional detonation)
Modern sandbox platforms combine:
- multi-OS detonation (Windows/macOS/Linux/Android, etc.)
- behavior scoring and classification
- automated verdicts at scale
- anti-evasion capabilities
- integration with threat intel / security controls
For example, FortiSandbox (by Fortinet) describes AI-powered behavioral analysis (“Dynamic AI Scan”), ML-driven rating/scoring, anti-evasion, and multi-OS VM coverage (including Windows, macOS, Linux, Android, and ICS environments). (Fortinet)
That combination matters because attackers frequently test payloads against “basic sandboxes.” If the sandbox is predictable, they try to evade it. The stronger platforms invest heavily in realism + anti-evasion + better behavioral models. (Fortinet)
How sandboxing fits into email security (what “good” looks like)
A modern email protection stack should look like this:
Layer 1 Fast pre-filtering (still essential)
- SPF/DKIM/DMARC alignment
- reputation and basic anti-spam
- known-bad URL and attachment blocking
Layer 2 Content and intent detection
- NLP/ML for phishing intent, impersonation, BEC patterns
- image/QR analysis where relevant
- attachment structure checks (HTML smuggling patterns, script containers)
Layer 3 Sandboxing for unknowns
- detonate suspicious attachments and links
- capture behavior and score risk
- block/quarantine based on verdict
Layer 4 Post-delivery response
- retroactive quarantine if a verdict changes
- IOC enrichment for SOC visibility
- user notification and reporting
This layered model is important because attackers deliberately mix social engineering and technical payloads. Email security must handle both.
What to look for in a sandboxing solution
If you’re evaluating sandboxing for email security, prioritize:
Detonation realism and OS coverage
Multi-OS VMs and customizable environments reduce false negatives. (Fortinet)
- Behavioral analysis + ML scoring
You want verdicts that keep improving as new campaigns emerge. (Fortinet) - Anti-evasion techniques
Many payloads attempt to detect virtual environments. Anti-evasion and interaction recording help. (Fortinet) - Email workflow integration
Sandboxing must integrate cleanly with your email gateway/security layer so suspicious items get submitted automatically and verdicts trigger actions. (Fortinet documents common integration patterns with email security workflows.) (Fortinet Documentation) - Actionability
Clear reporting: what happened, what process started, what network calls occurred, why it’s malicious.
The business argument (this is why it sells internally)
Sandboxing isn’t just “more security.” It’s a reduction in:
- account compromise incidents (credential theft campaigns)
- ransomware exposure from email entry points
- helpdesk churn from constant phishing noise
- executive risk from BEC-style attacks
And most importantly: it closes the gap where unknown threats are strongest the first hours/days of a new campaign.
Practical next step
If your current email security relies mainly on signatures and reputation, you don’t need to throw it away. You need to add a behavior-based layer that can stop unknown attachments and staged delivery links.
A good starting plan:
- identify your most common inbound vectors (links vs attachments, QR, HTML lures)
- enable sandbox detonation for suspicious objects
- tune exemptions and timeouts (avoid blocking business-critical flows unnecessarily)
- define response playbooks (quarantine + retroactive cleanup + reporting)
Want this implemented properly?
If you want to turn this into a practical project, we can package it as an Email Threat Modernisation Sprint:
- baseline review of current filtering
- threat-vector profiling (what actually hits your users)
- sandboxing integration design
- pilot rollout + tuning
- measurable outcomes (reduced successful phish, reduced risky clicks, faster containment)
If you tell me what email platform you use (Microsoft 365, Google Workspace, hybrid), I’ll adapt this article into a more “offer-driven” version with a fixed scope, timeline, and deliverables for your website.
