A well-tuned security awareness program will fill up your team’s inbox with malware, phishing, and incident reports needing your immediate attention. With additional security tasks and multiple hats, you need to quickly analyze the malicious content delivered to the user’s inbox to triage the threat. Handling live malware is fun, but it’s also like handling a loaded bazooka. One misstep could get you fired (pun intended). This talk will discuss considerations, safety, tips, and steps to build your own Incident Response (IR) AWS sandbox used to quickly analyze malicious content without sacrificing production systems and networks.