Sandboxes can still be dirtied, and would not have stopped the recent Apple Mail zero-day. For that you need static analysis on file formats, but this is a rec

Sandboxes can still be dirtied, and would not have stopped the recent Apple Mail zero-day. For that you need static analysis on file formats, but this is a recent technique and not something that scanners have historically been good at (e.g. Moxie's recent reverse file format strike on Cellebrite). Nevertheless, it comes down to defense-in-depth. There's no silver bullet.