Boost SASE Security with Advanced Sandboxing

Browsing the internet is a basic requirement for the modern workforce. Yet browsing the web means a continuous process of downloading files, which brings with it the very real risk of downloading infected files.

Recently, for example, a U.S.-based healthcare company suffered a ransomware attack after an employee downloaded what they thought was a legitimate file.1 The attack shut down some of the company’s systems as well as gaining access to patient records—complicating treatments.

At the same time, threat actors are discovering new or unusual ways to deliver malware via PDFs or office documents such as the Foxit exploit Check Point Research discovered in May 2024.2

To secure your organization from such risks, you need threat emulation (also known as sandboxing) as part of your network security. Sandboxing means running a suspicious file in an isolated virtualized environment to see if it contains any malicious threats. This is especially powerful for the discovery of zero- day, or ever before seen, threats that standard security measures could miss.

But the realities of the modern, distributed workforce can make some emulation solutions less optimal.

An on-prem solution, for example, may be ideal for users in the office, but remote users would need to backhaul their traffic to the company data center for inspection. That means slower results and hampered productivity.

A better solution for remote workers is cloud-based threat emulation that makes the security solution available globally,

Boost SASE Security with Advanced Sandboxing 1

regardless of location. Cloud-based emulation provides greater scrutiny over malicious files and zero-day threat discovery, without negatively impacting productivity and network performance.

Check Point’s SASE + ThreatCloud AI

Check Point’s Threat Emulation leverages ThreatCloud AI for an advanced approach to detection. ThreatCloud AI is the brain behind all of Check Point’s products combining the latest AI technologies with big data threat intelligence to identify and prevent attacks. Once ThreatCloud detects a zero-day threat, for example, it can quickly and easily share that information automatically protecting Check Point customers from the latest threats.

True to our hybrid nature, however, Check Point’s SASE helps enhance security and performance even more. We send suspicious files directly from the user device to ThreatCloud with no need for an added stop at a SASE gateway--providing even faster results and increased productivity.

When a suspicious file is detected, the file is sent securely to ThreatCloud for further analysis. ThreatCloud then “detonates” the file in a virtual sandbox to observe the file's behavior in a controlled environment and delivers a verdict on its safety. A process that happens in minutes.

Check Point ensures your workforce is protected, even when working remotely. By sending files directly to ThreatCloud AI, it eliminates the need for users to be connected to the corporate network, providing seamless and continuous protection.

1 Bleeping Computer - Ascension hacked after employee downloaded malicious file, Sergiu Gatlan, June 13, 2024. 2 CheckPoint.com - Foxit PDF “Flawed Design” Exploitation, Antonis Terefos, May 14, 2024.

https://www.bleepingcomputer.com/news/security/ascension-hacked-after-employee-downloaded-malicious-file/ https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/

Key Features of Check Point’s Threat Emulation • Hybrid Architecture: Faster, simpler, and

more efficient protection that skips the extra cloud gateway step.

• Real-Time Threat Intelligence: ThreatCloud’s real-time updates keep Check Point solutions one-step ahead of threat actors.

• Rapid and Accurate Detection: The fastest pre-screening engine in the industry provides quick and precise threat detection.

• Wide File Type Support: Supports various file types, including Office documents, PDFs, executables, and more, ensuring comprehensive protection.

Common Use Cases

Security for Remote Workers Scenario: Employees frequently work from home or other remote locations.

Solution: Check Point ThreatCloud eliminates backhauling and provides added security without slowing you down, securing the workforce wherever they are.

Third-Party Collaboration Scenario: Businesses often receive files from partners, clients, or third-party vendors.

Solution: Threat Emulation analyzes suspicious incoming files in a virtual sandbox preventing malware from spreading across a corporate network.

Global Operations Scenario: Companies operate in multiple countries and regions with varying levels of network security.

Solution: Globally available file sandboxing provides consistent protection across all locations.

Regulatory Compliance Scenario: Businesses must comply with strict data protection regulations and industry standards.

Solution: Threat Emulation helps organizations meet compliance requirements by providing a secure and auditable process for file inspection and threat detection.

Sandboxing You Can Trust

Check Point's Threat Emulation provides a vital layer of security for modern organizations. Powered by ThreatCloud AI, it provides real-time threat intelligence, rapid and accurate malware detection, and seamless integration, ensuring your workforce remains protected no matter where they are.

Get comprehensive, scalable, and efficient security, and safeguard your operations against an ever-evolving threat landscape with Check Point.

Talk to an Expert

Boost SASE Security with Advanced Sandboxing 2

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599 U.S. Headquarters 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391 www.checkpoint.com © 2025 Check Point Software Technologies Ltd. All rights reserved.

https://www.perimeter81.com/demo-cp?utm_source=cp&utm_content=DTS&utm_medium=PDF&utm_campaign=threat_emulation https://www.checkpoint.com/