Microsoft Defender Application Guard Is Retired: What Replaces It

Microsoft Defender Application Guard, which opened untrusted websites in Edge inside a hidden virtual machine, is retired. It is not available in Windows 11 version 24H2 or later, it has been removed from Microsoft Edge for Business, and the Chrome and Firefox extensions are gone too. Earlier Windows versions keep it only until their own support ends, with Windows 11 23H2 Enterprise and Education ending on November 10, 2026. There is no single replacement. For home users, Windows Sandbox on Pro gives the same "open it in a throwaway Windows" protection, while Edge's enhanced security mode, SmartScreen and Smart App Control cover everyday browsing. Businesses move to Edge for Business security, attack surface reduction rules, App Control for Business and Defender for Endpoint.

Ethan used to open every link from unknown clients in an Application Guard window, a habit Jake had taught him years earlier on his Windows 10 Pro laptop. After upgrading to Windows 11 24H2, the "New Application Guard window" option had vanished from Edge's menu, and he called Jake, worried that something was broken. Nothing was broken; the feature was gone by design. Jake set him up with Windows Sandbox for the truly suspicious links and attachments, turned on Edge's strict security mode and Smart App Control for everything else, and showed him how to check a link before clicking. This page explains what Application Guard did, why Microsoft retired it, and exactly what to use instead.

If your PC still shows Application Guard options, it is running an older version of Windows or Edge. Those options will stop working as support for those versions ends, so it is worth moving to the replacements now rather than later.

What Application Guard did

Application Guard was a hardware-isolation feature. When you opened a website your organization had not marked as trusted, or chose to open a new Application Guard window yourself, Edge ran that page inside a lightweight Hyper-V virtual machine, separate from your real Windows. If the site carried malware or an exploit, it attacked the throwaway container, not your PC. When you closed the window, the container and anything in it were discarded.

Microsoft first showed it in 2016 as a "virtual environment" for Edge, released it for Windows 10 Enterprise in 2017, and brought it to Windows 10 Pro in 2018. Extensions later let Chrome and Firefox send untrusted sites to the same container, and a separate version protected Office documents. At its peak it was one of the strongest browser protections on any desktop operating system.

The cost was convenience: pages in the container were slower, could not easily save files to the real PC or print without policy changes, did not keep sign-ins between sessions, and needed a PC with virtualization, enough memory and the right edition. Many home users never turned it on, and many businesses found the restrictions hard to live with.

Seen from today, Application Guard was a bridge: it protected people during years when browsers were easier to exploit, and its ideas moved into Windows itself. Understanding that helps explain why its replacements are spread across several features instead of one.

Retirement timeline

Windows 10 PCs that still have it lost mainstream support when Windows 10 reached end of support in October 2025; Extended Security Updates keep Windows 10 patched, but they do not bring retired features back to life, and newer Edge releases no longer include it. In practice, Application Guard should be treated as gone.

Why Microsoft retired it

Microsoft's explanation was that Edge's own protections had caught up. Since Application Guard was designed, browsers have gained strong sandboxing of their own, site isolation that runs each site in its own process, faster security updates, and reputation services that block known-bad sites before they load. Edge added an enhanced security mode that turns off risky just-in-time compilation for unfamiliar sites, closing a common route for exploits. Together, these give much of the protection Application Guard offered, without a virtual machine, the slowdowns or the broken printing and downloads.

There were practical reasons too. Running a hidden virtual machine for every untrusted site used memory and processor time, did not work on many lower-cost PCs, and caused support headaches. Fewer customers used it than Microsoft hoped. Retiring it let Microsoft focus on protections that work for everyone, on every edition.

For home users, the change mostly means one thing: the protection that was once an optional feature on Pro is now built into the browser on every edition, including Home, and turned on by default.

Do you still have it? How to check

1. Open Settings > System > About and note your Windows version, such as 23H2, 24H2 or 25H2.
2. On 24H2 or later, Application Guard is not available; skip to the replacements below.
3. On older versions, press Windows + R, type optionalfeatures and press Enter.
4. Look for Microsoft Defender Application Guard in the list. If it is checked, it is installed.
5. In Edge, open the three-dot menu and look for New Application Guard window. Current Edge versions no longer show it.

If the feature is installed on an older Windows version, you can leave it until you upgrade, but plan the switch now. When you upgrade to 24H2 or later, it is removed automatically.

If you are on Windows 11 23H2 Enterprise or Education and still rely on Application Guard, you have until November 10, 2026 at most, and newer Edge releases may stop supporting it sooner. Treat the remaining time as a migration window rather than a reason to wait.

Windows Sandbox: the closest replacement at home

Windows Sandbox uses the same kind of hardware isolation as Application Guard, but for the whole desktop rather than a single browser window. It opens a clean, temporary copy of Windows in a window on your desktop. Anything you do inside, open a link, run a downloaded file, open an attachment, stays inside. Close the window and everything in it is deleted for good. Next time you open it, it is brand new again.

1. Make sure you have Windows 11 Pro, Enterprise or Education. Sandbox is not available on Home.
2. Check that virtualization is on: open Task Manager, go to Performance > CPU, and look for Virtualization: Enabled. If it is disabled, turn it on in your PC's firmware settings.
3. Press Windows + R, type optionalfeatures and press Enter.
4. Check Windows Sandbox and select OK, then restart when asked.
5. Open Windows Sandbox from the Start menu.
6. Copy a suspicious file from your PC and paste it into the Sandbox window, or open Edge inside Sandbox and visit the suspicious link.
7. When you are done, close Sandbox and confirm that everything inside will be discarded.

Sandbox needs at least 4 GB of memory, and 8 GB or more makes it comfortable, plus a processor with virtualization and two or more cores. If it will not start, our guide to Windows Sandbox won't start covers the common errors.

Sandbox will not turn on? Common causes

• Windows Sandbox is missing from the features list: the PC runs Home. Sandbox needs Pro, Enterprise or Education.
• The checkbox is grayed out: virtualization is off in the firmware, or the processor does not support it. Turn on Intel VT-x or AMD SVM in the firmware settings.
• Error on starting: a damaged installation or a missing component; turning the feature off, restarting and turning it on again often fixes it.
• Running inside a virtual machine: Sandbox needs nested virtualization enabled on the host.
• Slow or black window: not enough free memory; close other apps or give it more memory in a .wsb file.

Third-party security software that uses its own virtualization can occasionally conflict with Sandbox; updating it usually resolves the problem.

What isolation cannot protect against

Application Guard and Windows Sandbox both protect your PC from malicious code. Neither protects you from phishing. If you open a fake bank login page inside Sandbox and type your real password, the attacker receives the password just the same; the container only stopped the page from infecting your PC. The same goes for scam sites that persuade you to pay, call a fake support number or install remote access software. Isolation is about code; phishing is about people, and the defenses are different: passkeys, password managers that refuse to fill on lookalike sites, two-step verification and a habit of checking the address bar.

That is why Jake set up both kinds of protection for Ethan, not just a replacement container.

Using Sandbox safely and well

• It starts clean every time. Nothing you install or save survives closing it, so copy out anything you need first.
• Copy and paste work both ways. Be careful copying files out; if something was malicious, copying it to your real PC defeats the purpose.
• It has internet access by default. That is what lets you test links. Advanced users can turn networking off with a configuration file for testing files that should not phone home.
• Configuration files with the .wsb extension can set memory, networking, shared read-only folders and startup commands, so you can open a prepared Sandbox with one double-click.
• Do not sign in to real accounts inside. If a site is suspicious enough for Sandbox, do not type passwords there.
• It is not invisible. Some malware detects virtual machines and behaves innocently; a clean result in Sandbox is reassuring, not a guarantee.

Ethan keeps Sandbox pinned to his taskbar. When a new client sends an unexpected ZIP file or an unfamiliar link, it opens there first, and only files that look exactly as described make it onto his real PC.

A simple Sandbox configuration for links

A Windows Sandbox configuration file is a small text file with a .wsb extension that tells Sandbox how to start. Create one in Notepad with a <Configuration> section, add <MemoryInMB>4096</MemoryInMB> to give it 4 GB of memory, and, if you want to test a file without letting it reach the internet, add <Networking>Disable</Networking>. A <MappedFolders> section can share one folder from your PC, such as a Downloads-to-check folder, with <ReadOnly>true</ReadOnly> so nothing inside Sandbox can change your real files. Save it as, for example, CheckFiles.wsb, and double-click it to start Sandbox with those settings.

Keep two configurations: one with networking for checking links, and one without networking and with a read-only shared folder for checking files. That way you never have to remember the right settings when something suspicious arrives.

Edge's enhanced security mode

Edge's enhanced security mode is Microsoft's main answer for everyday browsing. It turns off the browser's just-in-time JavaScript compiler on sites you do not visit often and adds operating-system protections that make memory-based exploits much harder. Sites you use regularly keep full speed.

1. Open Edge and go to Settings > Privacy, search, and services.
2. Find the Security section and the option to enhance your security on the web; if the layout differs, type "enhance your security" in the Settings search box.
3. Turn it on and choose Balanced, which applies extra protection to sites you rarely visit, or Strict, which applies it to all sites.
4. Add sites that misbehave to the exception list on the same page.

Balanced suits most people. Strict is stronger but can make some complex web apps slower or break minor features; try it for a week and add exceptions as needed. Ethan uses Strict and has had to add only two exceptions, both large web-based design tools.

Enhanced security mode also protects against flaws that have not been publicly fixed yet, because it removes the browser features those attacks most often exploit. That is the closest everyday equivalent to Application Guard's "even if the site is malicious, it cannot reach your PC" promise, without the container.

Microsoft Defender SmartScreen

SmartScreen checks websites and downloads against Microsoft's reputation service and blocks known phishing sites, malware sites and malicious files, showing a red warning page instead. It is on by default in Edge and in Windows itself. Make sure it is: in Edge, look under Settings > Privacy, search, and services > Security for Microsoft Defender SmartScreen, and turn on Block potentially unwanted apps in the same place.

In Windows, open Windows Security > App & browser control > Reputation-based protection and make sure the options are on, including Phishing protection, which can warn you when you type your Windows password into an unsafe site or app. SmartScreen does not isolate anything the way Application Guard did, but it stops most dangerous sites before they load, which matters more day to day.

Edge download protection

Edge checks every download with SmartScreen and warns you about files that are known to be malicious or are rarely downloaded. A warning such as "This file isn't commonly downloaded" does not always mean danger, but it does mean the file has no reputation yet. Selecting Keep requires a deliberate extra step for that reason. For anything you did not expect, choose Delete, or keep it and open it only in Sandbox.

Edge also lets you be asked where to save each file, under Settings > Downloads, which avoids files landing silently in Downloads, and it can block downloads entirely by policy on managed PCs. Combined with Smart App Control, which blocks untrusted programs even after they are saved, downloads are far less risky than they were when Application Guard was designed.

Downloaded files also carry a hidden mark showing they came from the internet, which is what triggers Protected View in Office and extra warnings in Windows when you open them. Avoid removing that mark with the Unblock checkbox in a file's properties unless you are certain the file is safe, because it switches those extra checks off for that file.

Smart App Control and Defender

Smart App Control, in Windows Security > App & browser control, blocks programs that are not known to be safe or signed by a trusted publisher. It is the strongest built-in protection against malicious downloads on Windows 11 home PCs. It is available on clean installations of Windows 11 and, on recent versions, can be turned on later from the same page if it was off.

Microsoft Defender Antivirus with real-time protection catches threats that get past the browser. Check that it is on; our guide to real-time protection shows where. For a deeper check, especially after visiting a suspicious site outside Sandbox, run a full scan and, if anything looks wrong, a Microsoft Defender Offline scan.

If Smart App Control blocks a program you trust, check for a signed version from the developer's own site before considering turning the feature off; turning it off is often not reversible without a reset on older Windows 11 versions.

Core isolation and memory integrity

Application Guard relied on virtualization-based security, and that technology lives on in Windows' core isolation features. Open Windows Security > Device security > Core isolation details and make sure Memory integrity is on. It uses the same hardware virtualization to protect the core of Windows from malicious code, so even if something gets in through the browser, it has a much harder time taking over the system.

Memory integrity is on by default on most new Windows 11 PCs. If it is off because of an incompatible driver, Windows Security lists the driver; updating or removing it usually lets you turn memory integrity on. It is one of the most important protections on a modern PC and costs little in performance on current hardware.

Use a standard account day to day

One of the simplest protections has nothing to do with isolation: using a standard user account for everyday work and keeping the administrator account for installs and changes. Malware that arrives through the browser runs with the permissions of the account you are using. In a standard account, it cannot install drivers, change system settings or affect other users without an administrator password, which limits what a successful attack can do. Combined with User Account Control set to always notify, it is a protection Application Guard users often overlooked.

Switching takes a few minutes: create a new administrator account, sign in to it, and change your everyday account to standard in Settings > Accounts > Other users.

Phones and tablets

Application Guard never existed on phones, and neither does Windows Sandbox, but phone browsers are already heavily sandboxed by the operating system. Edge on Android and iPhone includes SmartScreen, and Chrome on mobile has Safe Browsing. Keep the phone's operating system and browser updated, install apps only from the official store, and treat links in text messages with the same suspicion as email links; text-message phishing is now one of the most common scams.

On tablets running Windows, such as Surface devices, everything on this page applies in full, including Sandbox on Pro models.

On Android, also check that Google Play Protect is on in the Play Store settings, since it scans installed apps for known threats.

If you use Chrome or Firefox

The Application Guard extensions for Chrome and Firefox were retired with the feature. Both browsers have their own protections worth turning on. In Chrome, open Settings > Privacy and security > Security and choose Enhanced protection, which checks sites and downloads in real time against Google's Safe Browsing service and warns about risky extensions. In Firefox, Settings > Privacy & Security has Block dangerous and deceptive content and HTTPS-Only Mode. Windows Sandbox, SmartScreen for Windows, Smart App Control and Defender protect you whichever browser you use, because they work at the Windows level.

Office documents: Protected View instead

Application Guard for Office opened untrusted Word, Excel and PowerPoint files inside a container. It too is retired. The replacement is a combination that already exists in every copy of Office:

• Protected View opens files from the internet, email attachments and unsafe locations in a read-only mode with editing and macros disabled. Leave it on in File > Options > Trust Center > Trust Center Settings > Protected View.
• Macros from the internet are blocked by default in current Office versions; a file downloaded from the web cannot run macros unless you deliberately unblock it.
• Attack surface reduction rules in Microsoft Defender can stop Office apps from creating child processes, injecting code or writing executable files, which blocks most document-based attacks.

Think twice before selecting Enable Editing or Enable Content on a document you did not expect. Most document malware needs you to click one of those. When in doubt, open the file in Windows Sandbox, or ask the sender through a different channel whether they really sent it.

For businesses: what replaces Application Guard

Organizations that used Application Guard to isolate untrusted sites have a set of replacements, which together cover more ground than the old feature:

• Edge for Business security policies: enhanced security mode enforced by policy, SmartScreen that users cannot bypass, download restrictions and site lists.
• Microsoft Defender for Endpoint: web protection, network protection that blocks malicious domains in every browser and app, and endpoint detection and response.
• Attack surface reduction rules: block common malware techniques from Office, scripts and email.
• App Control for Business: allow-list which programs can run, so a malicious download simply cannot start.
• Data loss prevention and Defender for Cloud Apps: control what can be uploaded, downloaded or copied on risky sites.
• Remote browser isolation services: third-party products that run untrusted sites on a remote server and stream them to the user, for organizations that want true isolation.

Microsoft's guidance is to retire Application Guard policies and Isolated App Launcher dependencies before moving to Windows 11 24H2, and to test the replacements with the same site lists. Our guide to "Managed by your organization" helps home users who see leftover policies on a former work PC.

A practical migration order for IT teams: first enforce enhanced security mode and SmartScreen in Edge, then turn on network protection and attack surface reduction rules in audit mode, review the reports, switch them to block, and finally plan App Control for the highest-risk devices. Each step can be measured before the next, and none depends on the old container.

Email: Safe Links and Safe Attachments

For many organizations, the risky links Application Guard isolated arrived by email. Microsoft Defender for Office 365, included in some business plans, adds Safe Links, which checks each link at the moment it is clicked rather than when the email arrived, and Safe Attachments, which opens attachments in a protected environment in the cloud before they reach the inbox. These do in the cloud what Application Guard did on the PC, without slowing down the user's machine, and they work on phones too.

Home users get a lighter version of the same idea: Outlook.com and Gmail both scan attachments and flag suspicious links, and both show warnings on messages from unknown senders. Treat those warnings seriously rather than clicking past them.

Removing Application Guard leftovers

On PCs still running an older Windows version, remove Application Guard before upgrading to keep things tidy. Press Windows + R, type optionalfeatures, uncheck Microsoft Defender Application Guard, select OK and restart. In managed environments, remove the Application Guard Group Policy or Intune settings and any network isolation site lists created only for it, so they do not confuse troubleshooting later. Removing the feature does not affect Windows Sandbox, Hyper-V or memory integrity, which are separate features.

If a former work PC shows Application Guard policy messages after you take it home, the policies are leftovers; our guide to "This setting is managed by your administrator" in Windows Security explains how to clear them safely.

Keep a note of any site lists you remove, in case a replacement such as network protection or Edge site policies needs the same trusted domains later.

Application Guard vs the replacements

No single row replaces Application Guard on its own. Together, they protect more of what you do than Application Guard ever did, because they also cover downloads, documents and programs, not only browser windows.

Myths about the retirement

• "Windows is less secure without it." For most users the replacements cover more, including downloads and documents.
• "Edge is unsafe now." Edge has stronger built-in protections than when Application Guard launched.
• "I need Pro for safe browsing." Only Sandbox needs Pro; everything else works on Home.
• "Staying on an old Windows version keeps it." Only until that version's support ends, and unpatched Windows is far riskier than a missing feature.
• "InPrivate is the new Application Guard." InPrivate only clears local history and cookies.

The retirement is a change of tools, not a loss of safety, as long as the replacements are actually turned on.

On Windows 11 Home

Home has no Windows Sandbox and never had Application Guard, but it still has every other protection on this page: Edge enhanced security, SmartScreen, Smart App Control, Defender, core isolation and Protected View. For occasional testing of a suspicious file, a free virtual machine program such as VirtualBox can run a separate copy of Windows or Linux; it takes more setup than Sandbox and does not reset itself automatically, so take a snapshot after installing and restore it after each test.

For most Home users, the honest advice is simpler: do not open the suspicious file at all. Ask the sender, delete it, or upload it to a scanning service if you must know what it is.

Protecting children's browsing

Families who used Application Guard to protect children from dangerous sites have better tools now. Microsoft Family Safety filters inappropriate websites and searches in Edge for child accounts, turns on SafeSearch, and can limit browsing to allowed sites for younger children. Combined with SmartScreen, a standard user account and Smart App Control, a child's account is well protected without any virtual machines. For other browsers, Family Safety can block them so children use Edge, where filtering applies.

Review the Family Safety activity report weekly at first; it shows blocked sites, which tells you whether the filter is too strict or whether a child is being sent to risky pages by friends or games.

Network-level protection at home

Another layer works for every device on your home network: a filtering DNS service. Several well-known public DNS providers offer free options that refuse to resolve known malware and phishing domains, and some routers have this built in as a security or parental control feature. Setting it once on the router protects phones, tablets, smart TVs and visitors' devices as well as your PCs. It does not replace browser protections, but it catches threats on devices that have none.

Change the DNS setting in the router's administration page, usually under internet or WAN settings, and note the old values first so you can switch back if any site misbehaves.

Hyper-V for persistent testing (Pro)

On Pro, Hyper-V runs full virtual machines that keep their state between sessions, unlike Sandbox. Turn it on in optionalfeatures by checking Hyper-V, restart, then open Hyper-V Quick Create to set up a Windows or Linux virtual machine. Take a checkpoint once it is set up; after testing anything risky, apply the checkpoint to return the machine to its clean state.

Hyper-V suits people who test software often or need a separate environment with its own apps installed, such as a browser profile used only for risky research. For occasional one-off checks, Sandbox is quicker, because it is always clean without any checkpoints to manage.

Safe browsing habits that matter more than any feature

• Check links before clicking: hover to see the real address, and look for misspelled domains.
• Type addresses for banks and important accounts rather than following links in email or messages.
• Use passkeys or a password manager, which will not fill passwords on lookalike sites.
• Turn on two-step verification for email, banking and cloud storage.
• Keep Windows, Edge and Office updated; most exploits target old versions.
• Be suspicious of urgency: "your account will be closed today" is a classic phishing line.
• Verify unexpected attachments with the sender through a different channel.

Application Guard protected you after you clicked. These habits protect you before, and they work in every browser on every device.

A separate browser profile for risky research

If you often visit unfamiliar sites for work, such as researching suppliers, checking competitors or reading forums, a separate browser profile adds a simple layer. Create one in Edge from the profile button at the top left, or in Chrome from the profile icon at the top right. Do not sign in to your email, bank or other accounts in it, and keep extensions to a minimum. If a site in that profile tries to steal cookies or sign-ins, there is nothing there to steal.

It is not isolation in the Application Guard sense, since the profile runs on your real Windows, but combined with enhanced security mode it keeps risky browsing well away from the accounts that matter.

Give the profile a distinct color and name, such as "Research - no accounts", so you always know at a glance which one you are in before typing anything.

Check a link or file without opening it

Before opening anything suspicious at all, a few checks often settle the question:

• Read the real address: hover over a link, or right-click and copy it, then read it in Notepad. A link that says your bank but points to a different domain is phishing.
• Look at the file type: turn on file name extensions in File Explorer's View > Show menu. An "invoice.pdf.exe" is a program, not a document.
• Check the digital signature: right-click a program, choose Properties > Digital Signatures, and see who signed it. Unsigned installers from unknown sources deserve suspicion.
• Scan before opening: right-click the file and choose Scan with Microsoft Defender.
• Use an online multi-engine scanner for a second opinion on a file you are unsure about, remembering that anything you upload to such services may become visible to their researchers, so never upload private documents.

These checks take under a minute and avoid opening most dangerous files in the first place.

Privacy is a separate layer

Isolation and security features protect your PC from malicious code; they do not stop websites from tracking you. For that, Edge has tracking prevention, with Basic, Balanced and Strict levels. Our guide to tracking prevention in Edge covers setting it up. Balanced suits most people; Strict blocks more but can break some sites. InPrivate windows clear cookies and history when closed, but they are not a security feature: a malicious site is just as dangerous in an InPrivate window as in a normal one.

Security and privacy settings work well together: strict tracking prevention also blocks many malicious ad networks, which have been a route for malware on otherwise legitimate sites.

Clicked something suspicious? What to do

1. Close the tab or window straight away; do not type anything into it.
2. If you entered a password, change it at once from a trusted device, starting with email.
3. If a file downloaded, delete it without opening it, and empty the Recycle Bin.
4. Run a full scan with Microsoft Defender; our guide to scanning with Microsoft Defender shows how.
5. If the scan finds anything or the PC behaves oddly, run a Microsoft Defender Offline scan.
6. Check your browser for new extensions and reset its settings if the home page or search engine changed.
7. Watch your accounts and bank statements for unusual activity over the next few weeks.

Most clicks on suspicious links end with nothing worse than a blocked page, thanks to SmartScreen. These steps cover the cases where something did get through.

Ethan's setup after Application Guard

1. Windows Sandbox pinned to the taskbar, with one configuration for links and one offline configuration for files.
2. Edge enhanced security mode set to Strict, with two exceptions.
3. SmartScreen and potentially unwanted app blocking on in Edge and Windows Security.
4. Smart App Control and memory integrity on.
5. A separate Edge profile, with no accounts signed in, for researching unfamiliar sites.
6. File name extensions shown in File Explorer.
7. Passkeys and two-step verification on his email and bank.

It took Jake about half an hour to set up, and Ethan says it feels less intrusive than Application Guard ever did, because most of it works silently in the background.

What this page said in 2016

When this page was first written in September 2016, Microsoft had just announced a "virtual environment" for Edge that would open untrusted sites in an isolated container, promised for enterprise customers. It shipped the following year as Windows Defender Application Guard and later became Microsoft Defender Application Guard. Ten years on, the story has come full circle: browsers have become secure enough on their own that Microsoft has removed the container, and the isolation idea lives on in Windows Sandbox and virtualization-based security.

The original 2016 version of this page promised a feature for businesses that most home users never saw. Its successors, by contrast, are on by default for everyone, which is arguably the better outcome.

Application Guard: frequently asked questions

Ethan missed Application Guard for about a week. Then he realized that Sandbox did everything he used it for and more: he could test a ZIP file, not just a link. Strict mode in Edge, Smart App Control and SmartScreen quietly handle everything else. Jake's summary was the same one he gives every customer: features come and go, but the protection that never retires is pausing before you click.

Revision note. Written October 2, 2026, rewriting our 2016 announcement of Edge's virtual environment into a guide to Application Guard's retirement and what replaces it. May every risky click land somewhere disposable.