From a certain point of view, deception is similar to a sandbox by its nature. They both are artificial environments designed to detect malware or malicious behavior. However, all processes in the sandbox are launched intentionally by the person who has established the sandbox environment. Besides that, sandboxes partially imitate the real machine, since there is no need to make the programs believe that they’re running in a real environment. Meanwhile, deceptive decoys are trying to repeat the genuine system as realistic as possible. That is needed since both threat actors and malware will likely check-up if they are acting in a trap or on a normal machine.