ThreatLab
ThreatLab is a paid, on-premises malware analysis sandbox for security teams, with analysis running on hardware they control.
What ThreatLab is
ThreatLab is a paid, on-premises malware analysis sandbox for security teams, with analysis running on hardware they control. The maker, BrightByte Labs LLC, says samples are not uploaded. Isolated Hyper-V sessions provide live desktop control, file and URL analysis, session recording, and save-and-resume work. Sysmon monitoring captures process, network, file-system, and registry events in real time, while detections cover DLL injection, credential access, scheduled tasks, services, ransomware canaries, and certificate stores. An EVTX analyzer offers 2,900+ Sigma rules, timeline views, severity filters, and CSV or JSON export. ThreatLab creates custom-branded PDF reports with executive summaries, indicators of compromise, severity distribution, and technical details. Users can supply Anthropic, OpenAI, or Google API keys for AI analysis; keys are encrypted locally with AES-256-CBC.
Good
- Runs analysis on controlled hardware
- Interactive Hyper-V analysis sessions
- Real-time Sysmon event monitoring
- 2,900+ Sigma rules included
- Branded PDF reporting
Watch out
- No free plan
- Requires Windows Hyper-V hardware setup
- Plans above 10 seats need custom pricing
- Minimum listed hardware includes 16 GB RAM
Who it suits
It suits security teams needing local malware, URL, network, and indicator analysis on Windows or web management tools. Windows 10/11 Pro or Enterprise with Hyper-V is required for the listed system setup.
Verdict
ThreatLab combines local sandboxing with event analysis, reporting, VPN controls, and optional AI integrations. Its on-premises model and Windows requirements are central considerations for deployment.
Plans and prices
From ThreatLab's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Team | $84 a month | 3+ seats · Unlimited sessions · All features included · 15% volume discount · Monthly |
| Starter | $99 a month | 1–2 seats · Unlimited sessions · All features included · Monthly |
The facts
Each one read from ThreatLab's own pages, with the date it was checked.
What it does
- AI integrations
- Users can provide API keys from Anthropic, OpenAI, or Google for AI analysis; the page says keys are encrypted locally with AES-256-CBC.checked 7 Oct 2026
- Data handling
- The maker says samples are not uploaded and analysis runs locally on the user's hardware.checked 7 Oct 2026
- Event log analysis
- The built-in EVTX analyzer includes 2,900+ Sigma rules and supports timeline views, severity filtering, and CSV or JSON export.checked 7 Oct 2026
- Interactive analysis
- Its isolated Hyper-V sessions provide live desktop control, file and URL analysis, session recording, and save and resume.checked 7 Oct 2026
- Management and support
- A web management portal handles licenses, seat allocation, machine tracking, downloads, and documentation; the app also has issue reporting with optional log attachment.checked 7 Oct 2026
- Monitoring
- Sysmon monitoring captures process, network, file system, and registry events in real time.checked 7 Oct 2026
- Purpose
- ThreatLab is a local malware analysis sandbox for security teams, with analysis running on hardware they control.checked 7 Oct 2026
- Reporting
- It generates PDF reports with executive summaries, indicators of compromise, severity distribution, and technical details, with custom branding.checked 7 Oct 2026
- Seat limits
- A seat is one machine activation, and the maker says plans above 10 seats require contacting it for custom pricing.checked 7 Oct 2026
- System requirements
- The maker lists Windows 10/11 Pro or Enterprise 64-bit with Hyper-V, at least 16 GB RAM, 4 or more CPU threads with virtualization support, and 50 GB free disk space.checked 7 Oct 2026
- Threat detection
- The product includes DLL injection, credential access, scheduled task, service, ransomware canary, and certificate store monitoring.checked 7 Oct 2026
- VPN
- ThreatLab offers WireGuard VPN exit nodes in the US, UK, Germany, and Spain, with a kill switch that blocks internet access if the tunnel drops.checked 7 Oct 2026
The company
- Maker
- The site identifies the maker as BrightByte Labs LLC.checked 7 Oct 2026
Money
- Trial
- The maker offers a 30-day trial with full feature access and no credit card required; it says the license arrives by email within 12 hours.checked 7 Oct 2026
Alternatives to ThreatLab
- 1
Malwagon
Free planWebAPILinuxmacOS7.7From $79 a month - 2
ANY.RUN
Free planAndroidiOSWebAPI7.5Free plan - 3
CAPE Sandbox
Free planOpen sourceWebAPILinuxSelf-hosted7.4Free plan - 4
Detonate
Free planWebAPILinuxSelf-hosted7.3From $4,990 a year - 5
CrowdStrike Falcon Pro
AndroidiOSWebAPI7.1From $99.99 a year - 6
Retrace
Free planAndroidWebAPILinux6.9Free plan