What is WildFire (Palo Alto cloud sandbox), and what gap does it fill that signature-based AV cannot?

WildFire detonates unknown files in a cloud sandbox to catch zero-day malware that signature-based AV would miss.

Signature AV only catches what's already in the database. A brand-new piece of malware has no signature yet — it walks past. WildFire's role:

1. FW sees an unknown executable / Office macro / PDF / etc.
2. File is sent to Palo Alto's cloud sandbox.
3. Cloud detonates it in a clean VM, observes behavior (process spawning, network calls, persistence attempts, file encryption patterns).
4. ML + heuristics classify as benign / malicious.
5. If malicious → signature is generated and pushed to all WildFire customers globally within minutes.

Why this matters:

• One customer in Australia sees a new ransomware → 5 minutes later, your FW in Switzerland blocks it before anyone clicks.
• Cross-customer threat sharing is the real moat — a single org couldn't replicate this.

Tip: Sandbox = "let me run this malware in a padded room and see what it does." Like detonator squads use bomb-disposal robots — the threat is real but contained.

Go deeper:

• Sandbox in computer security (Wikipedia) — why researchers detonate untrusted code in an isolated environment to observe behaviour.
• WildFire datasheet (Palo Alto Networks) — vendor detail on the cloud sandbox: dynamic/static analysis plus inline ML for unknown threats.