A spam filtering service will include a signature-based antivirus engine. When a new malware variant is identified, the signature will be added to the virus definition list which will allow the malware to be identified and blocked. Signature-based antivirus engines will not detect brand new malware variants. Sandboxing addresses this gap by analyzing the behavior of email attachments to identify malicious actions.