I led the team for WildFire (the most widely used commercial sandbox and, I believe, the first one in the cloud) at Palo Alto Networks. If anyone from FireEye o

I led the team for WildFire (the most widely used commercial sandbox and, I believe, the first one in the cloud) at Palo Alto Networks. If anyone from FireEye or Lastline is around, maybe they'll chime in as well. The design of the analysis system itself determines your deployment constraints. For example, will you give the malware an open line to the Internet? If not, you'll miss out on most of its activity[1], but won't be limited in terms of hosting. If, on the other hand, you give the malware free reign, AWS wants no part of that (we tried it). 1. See the (speculated) anti-analysis kill switch in WannaCry. This sort of thing is common. But more fundamentally, malware also tends to work in stages, and often won't do much if it can't phone home.