Detonation is the controlled execution of suspicious content in an isolated environment so analysts can watch what it does without risking production systems. The sample may be an email attachment, a script, a document, or a link that launches further activity. By letting it run in a sandbox or lab, defenders can observe process creation, file writes, network calls, redirects, and other behavior that static inspection may miss.
Detonation matters because many modern threats are staged or delayed. An email body may look harmless, while the real payload appears only after a click, a browser redirect, or a timed action. In security operations, detonation helps reveal whether the content is benign, malicious, or part of a larger chain, and it supports better triage, detection engineering, and incident response. It is a defensive technique, but attackers also try to detect or evade sandboxing, which is why analysts often combine detonation with browser visibility and other telemetry.