Joe Security adds adaptive detonation to probe evasive malware

Reinach, Switzerland, 4 November 2026 — Joe Security has launched Adaptive Detonation, a new capability within Joe Sandbox AI designed to probe malware more deeply by countering evasion and unmet execution conditions. CyberNewswire reports that the feature uses AI agents to inspect execution results, identify obstacles preventing samples from revealing meaningful behaviour, and select targeted interventions.

When a sample appears inactive, Joe Sandbox AI applies actions such as patching blocking checks, creating required files or settings, adjusting the execution environment, or supplying missing command-line arguments, then re-runs the sample to verify whether the intervention exposes additional activity.

The system is aimed at security teams seeking deeper visibility into evasive threats. Adaptive Detonation addresses obstacles including keyboard restrictions, timing checks, firmware-based rejection, date requirements, and missing dependencies, according to the company. Joe Security describes the approach as linking observed evidence with targeted action and verification to help analysts understand why a sample remains dormant and to uncover activity that might otherwise stay hidden.

The feature is offered as part of Joe Sandbox AI, a plugin for Joe Sandbox Cloud, with access via Joe Sandbox Cloud Basic (the free community version) or through signing in for the AI-enabled offering. The article notes a blog post with technical details and case studies, along with links to the broader Joe Security site for background on the company, which is described as a privately owned Swiss software firm founded in 2011 and headquartered in Reinach.