Well Neorage,

Your heuristic scanner works on "algorithms" or rules............like if something tries to amend the registry, prepend or append to an executable, and so on............it will give you a warning.

Now, your "sandbox" is a different concept.............here, an incoming executable is put in an area where it's activity is monitored...........if it tries to access areas outside the sandbox.............it is a cheater.

A bit like home and away games...........heuristics are at home...........the sandbox is away?

I hope that explains