17.7
Malwagon is a cloud-based malware analysis sandbox for examining suspicious files and activity.
Free planWebAPILinux
Best Malware Analysis Sandboxes in 2026
When you need to inspect a suspicious file or URL, a malware analysis sandbox can provide a contained setting for analysis. Compare deployment model and file size limit with URL analysis, network traffic analysis, and IOC extraction to see which stated capabilities fit your investigation. API access and result retention may matter for connecting analysis to your workflow and keeping findings available. Free-plan…
27.5
ANY.RUN is a cloud-based malware analysis and threat intelligence service for security teams.
Free planAndroidiOSWeb
37.4
CAPE Sandbox is a free, open-source malware analysis tool that runs suspicious files in isolated virtual machines while recording behavior and forensic artifacts.
Free planOpen sourceWebAPILinux
- 4
Detonate
Detonate runs software dependencies in isolated micro-virtual machines and observes their runtime behavior for supply chain security.
Free planWebAPILinuxSelf-hosted7.3From $4,990 a year - 5
CrowdStrike Falcon Pro
CrowdStrike Falcon Pro is endpoint protection that combines antivirus prevention, threat visibility, built-in intelligence and response.
AndroidiOSWebAPI7.1From $99.99 a year - 6
Retrace
Retrace is an AI-powered malware analysis platform built around interactive sandboxes for Windows, macOS, Linux, and Android virtual machines.
Free planAndroidWebAPILinux6.9Free plan - 7
Symantec IT Management Suite
Symantec IT Management Suite manages, patches, and remediates application and operating system configurations across desktops, laptops, and servers…
WebAPILinuxmacOS6.8 - 8
ThreatLab
ThreatLab is a paid, on-premises malware analysis sandbox for security teams, with analysis running on hardware they control.
WebWindows6.3From $84 a month - 9
Cisco Catalyst Center
Cisco Catalyst Center is a centralized controller and management dashboard for enterprise network operations.
WebAPILinuxmacOS6.2 - 10
Hatching Triage
Hatching Triage is a cloud-based malware sandbox for automated analysis of suspicious files and URLs.
AndroidWebAPILinux6.1 - 11
SorbSecurity Cloud Sandbox
SorbSecurity Cloud Sandbox (SCS) analyzes suspicious files in isolated environments to help identify threats.
AndroidWebAPISelf-hosted6.1 - 12
Hybrid Analysis
Hybrid Analysis is a community malware analysis service for examining unknown files and URLs.
Free planWebAPI6.0Free plan - 13
ReversingLabs Cloud Sandbox
ReversingLabs Cloud Sandbox runs submitted files in isolated environments to observe what they do, complementing static analysis.
AndroidWebAPILinux6.0 - 14
Kaspersky Research Sandbox
Kaspersky Research Sandbox analyzes suspicious objects to investigate their origins, gather behavior-based indicators of compromise and identify…
AndroidWebAPILinux5.9 - 15
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, open-source system for automated black-box malware analysis powered by the DRAKVUF engine.
WebAPILinuxSelf-hosted5.8 - 16
FortiSandbox
FortiSandbox detects and classifies emerging or unknown threats, including zero-days, ransomware, malware, and AI-based attacks.
WebSelf-hosted5.3 - 17
VirusTotal Intelligence
VirusTotal Intelligence is a paid search service for examining files and related threat data in VirusTotal’s dataset.
WebAPI5.3 - 18
ThreatAnalyzer
ThreatAnalyzer is an automated malware analysis sandbox from VIPRE Security Group, the provider identified as a Ziff Davis subsidiary.
APISelf-hosted5.2 - 19
Trellix Intelligent Sandbox
Trellix Intelligent Sandbox is a threat analysis product designed to detect advanced, evasive malware and turn threat information into protective action.
WebAPISelf-hosted5.2 - 205.1
- 215.0
- 224.8
- 23
AhnLab MDS
LinuxWindows4.7 - 244.7
- 25
Palo Alto Networks WildFire
Palo Alto Networks WildFire is paid web software for examining URLs, files, and network traffic.
Web4.7