Symantec primarily utilizes a cloud-native sandbox. When an on-premise endpoint or email gateway encounters an unknown file, it is hashed and sent to the Symantec Cloud Sandbox. This relieves the endpoint of the heavy processing load required for virtual execution.
: For organizations requiring high-speed local processing, certain hardware appliances (like the CA S400 and S500) can run sandboxing tasks locally, reducing latency and keeping data on-premises.