1. A method of security sandboxing comprising: detecting an illicit intrusion to a computer on a first computer system; responsive to detecting the illicit intrusion to the computer, cloning the computer to create a copy of the computer; redirecting all traffic from the illicit intrusion to the computer to the cloned computer while directing all traffic not from the illicit intrusion to the computer; observing activities of the illicit intrusion interacting with the cloned computer while directing all traffic not from the illicit intrusion to the computer; and dynamically adapting the cloned computer to perform activities of predicted interest to the illicit intrusion based on the observed activities of the illicit intrusion on the cloned computer while directing all traffic not from the illicit intrusion to the computer, wherein the steps of the method are performed by one or more computing devices.