Safely analyse malicious code — static triage, dynamic sandboxing, and reading what it really does.
Isolated VMs, snapshots and the rules that keep malware from escaping.