Email SecurityIVX for Collaboration Platforms
Sandbox detonation for the files shared in Teams, Slack, and cloud storage.
Collaboration platforms are the least-protected attack vector — 94% of organisations have experienced a threat through them, yet Slack, Teams, Box, and OneDrive do not detonate files on ingest. Trellix Intelligent Virtual Execution (IVX) for Collaboration Platforms extends signature-less sandbox detonation to those channels, scanning every shared object for zero-day threats. Faltrox integrates and operates it across your collaboration stack.
Overview
What IVX for Collaboration Platforms is
Trellix Intelligent Virtual Execution (IVX) for Collaboration Platforms extends signature-less sandbox detonation to Slack, Teams, and cloud storage. Collaboration platforms are the least-protected attack vector — 94% of organisations have experienced a threat through them — yet these tools share files freely without detonating them on ingest. IVX closes that gap by scanning every shared object for zero-day threats.
The same IVX engine that protects email — a proprietary hypervisor instrumented for 200+ simultaneous executions across Windows, macOS, and Linux — is pointed at collaboration channels. It performs multi-flow analysis to understand a full multistage attack, detects sandbox-aware evasion, and returns rich JSON verdicts with MITRE ATT&CK mapping. Faltrox integrates and operates it across your collaboration stack.
Coverage
What it protects
The platforms, threats, and surfaces this product is built to defend.
Slack & Microsoft Teams
Detonates files shared in the collaboration channels that share content without inspection.
Cloud Storage
Integrates with Dropbox, Box, OneDrive, M365, and Google Workspace to scan shared objects.
Shared Files
Weaponised Office files, PDFs, images, and archives are detonated before they reach a colleague.
Embedded URLs
Inspects URLs inside documents and archives, including obfuscated, shortened, and typosquatting links.
Zero-Day Threats
Signature-less detonation confirms true zero-day malware, targeted attacks, bots, and APTs.
Multi-OS Detonation
200+ simultaneous executions across Windows, macOS, and Linux and application versions.
How it works
The mechanism
How the product moves from signal to protected state, step by step.
- 01
Integrate
IVX connects to collaboration platforms and cloud storage — Slack, Teams, M365, Google Workspace, Dropbox, Box, OneDrive.
- 02
Submit
Files and URLs shared through those channels are submitted to the IVX engine for analysis.
- 03
Detonate
A custom evasion-aware hypervisor runs 200+ simultaneous executions across operating systems for a definitive verdict.
- 04
Verdict
Returns a JSON verdict with file, registry, process, and network changes plus MITRE ATT&CK mapping and IOCs.
- 05
Act
Malicious content is flagged for blocking, and the context feeds straight into your SOC workflow.
Capabilities
Key capabilities
Signature-Less Detonation
A proprietary hypervisor instrumented for 200+ simultaneous executions detonates suspicious files, web objects, URLs, and attachments to confirm zero-day and evasive attacks that signature defences miss.
Collaboration Integrations
Integrates with Slack, Microsoft Teams, Microsoft 365, Google Workspace, and cloud storage like Dropbox, Box, and OneDrive — closing the gap where these platforms share files without inspection.
Multi-OS One-to-Many Analysis
Composes multiple unique execution environments in real time across Windows, macOS, and Linux, service packs, and application versions, running 200+ simultaneous executions per submission.
Multi-Flow Attack Context
Performs stateful, multi-flow analysis to understand a multistage attack from initial exploit to data exfiltration — not just a single object in isolation.
Evasion-Aware Hypervisor
A custom-built hypervisor with built-in countermeasures detects sandbox-aware and VM-aware malware that hides when it senses it is being analysed.
Embedded URL Inspection
Inspects URLs inside documents and archives, files downloaded through URLs including FTP, and obfuscated, spoofed, shortened, and typosquatting links.
Rich Verdict Context
Beyond a verdict, returns file, registry, process, and network changes plus MITRE ATT&CK mapping and IOCs in JSON, feeding your SOC workflow directly.
Flexible Deployment
Available on-premises or as a cloud-native service via Trellix channels or the AWS Marketplace, from IVX-VM virtual appliances to bare-metal models.
Specifications
Technical detail
- Detonation Capacity
- 200+ simultaneous executions per submission
- Collaboration Coverage
- Slack, Microsoft Teams, M365, Google Workspace, Dropbox, Box, OneDrive
- OS Coverage
- Windows, macOS, Linux
- Deployment
- Cloud-native (Trellix or AWS Marketplace) or on-premises (VMware/Nutanix, bare-metal)
- Output
- JSON verdict with ATT&CK mapping, IOCs, and extracted objects
Works with
Part of the platform
Trellix products this pairs with, and the Faltrox services that operate it.
Delivery
You buy the outcome, not the console
Managed by Faltrox
Faltrox licenses, deploys, and tunes Trellix IVX for Collaboration Platforms for your environment, then runs it as part of a managed service, so you get the protection without staffing another security console.
FAQ
Common questions
01Do Teams and Slack not already scan files?
Collaboration and file-sharing platforms allow free sharing but do not ensure the integrity of what is shared — they generally do not detonate files on ingest to block threats before they enter. IVX adds that sandbox inspection to the collaboration channel, which is a widely exploited and under-protected vector.
02How is this different from the email version of IVX?
It is the same IVX detonation engine pointed at a different set of channels. For collaboration platforms it integrates with tools like Slack, Teams, and cloud storage rather than the mail flow — so shared files and links get the same signature-less analysis email attachments do.
03Can malware detect the sandbox and hide?
IVX runs on a custom-built hypervisor with built-in countermeasures designed specifically to detect sandbox-aware and VM-aware evasion tactics, so malware that stays dormant when it senses analysis is still caught.
04What do we get back besides a verdict?
Rich contextual detail — file, registry, process, and network changes, MITRE ATT&CK mapping, extracted objects, and IOCs, delivered in JSON — so a detection integrates straight into your SOC workflow rather than being a standalone alert.
05On-premises or cloud?
Both. It is available as a cloud-native service through Trellix channels or the AWS Marketplace, or on-premises on VMware and Nutanix or bare-metal appliances — Faltrox scopes the model to your data-residency and throughput needs.
Start an engagement
Secure what’s next.
Speak with the engineering team to define scope, walk through the methodology, and decide whether Faltrox is the right team to test and run your environment.
Contact us