Attachment sandboxing means a suspicious file is opened in a safe isolated environment first, so the system can see how it behaves without exposing your users or devices to the threat directly.