# Best Malware Analysis Tools

  *By [Brandon Summers-Miller](https://research.g2.com/insights/author/brandon-summers-miller)*

   Malware analysis tools that are used to isolate and investigate malware as it is detected on a company’s IT resources, endpoints, and applications. They typically work by detecting malware and then moving infected resources to an isolated environment. In this secure, sandboxed environment, security professionals examine the malware’s code and behaviors to learn more about how it works, what it has done, and how to protect against it in the future.

Security teams and other IT staff involved in incident response, risk analysis, and security operations may all use these tools. They collect data from malware that is detected and use it to bolster security and prevent similar malware from compromising their system by integrating it with their existing threat intelligence systems. They may also use the information gathered to examine larger portions of their IT systems to ensure the malware is not present elsewhere.

Many malware analysis solutions provide features of [network sandboxing software](https://www.g2.com/categories/network-sandboxing) for secure analysis. Not all network sandboxing tools have the same ability to automatically detect malware nor the tools necessary for in-depth forensic investigation.

To qualify for inclusion in the Malware Analysis category, a product must:

- Detect zero-day threats and other unknown malware using contextual threat data
- Isolate threats in a secure environment
- Provide tools for forensic investigation and risk analysis





## Category Overview

**Total Products under this Category:** 53


## Trust & Credibility Stats

**Why You Can Trust G2's Software Rankings:**

- 30 Analysts and Data Experts
- 2,100+ Authentic Reviews
- 53+ Products
- Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.


## Best Malware Analysis Tools At A Glance

- **Leader:** [ESET PROTECT](https://www.g2.com/products/eset-protect/reviews)
- **Highest Performer:** [Intezer](https://www.g2.com/products/intezer-intezer/reviews)
- **Easiest to Use:** [ESET PROTECT](https://www.g2.com/products/eset-protect/reviews)
- **Top Trending:** [ANY.RUN Sandbox](https://www.g2.com/products/any-run-sandbox/reviews)
- **Best Free Software:** [ESET PROTECT](https://www.g2.com/products/eset-protect/reviews)

## Top-Rated Products (Ranked by G2 Score)
  ### 1. [ESET PROTECT](https://www.g2.com/products/eset-protect/reviews)
  Stay one step ahead of known and emerging cyber threats with our AI-native, prevention-first approach. ESET combines the power of AI and human expertise to make protection easy and effective. Experience best-in-class protection thanks to our in-house global cyber threat intelligence, compiled and examined for over 30 years, which drives our extensive R&D network led by industry-acclaimed researchers. ESET PROTECT, our cloud-first XDR cybersecurity platform combines next-gen prevention, detection, and proactive threat hunting capabilities. ESET's highly customizable solutions include local support and have minimal impact on performance, identify and neutralize known and emerging threats before they can be executed, support business continuity, and reduce the cost of implementation and management. HOW YOUR ORGANIZATION WILL BENEFIT - Improved protection against ransomware and zero-day threats via cloud-based sandboxing technology. - Helps comply with data regulations thanks to full disk encryption capabilities on Windows and macOS. - Easily accessible ESET PROTECT console improves TCO of security management. - Single-pane-of-glass remote management for visibility of threats, users, and quarantined items. - Company endpoints and mobiles are protected via advanced multilayered technology, now with brute-force attack protection.


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 942

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.9/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.6/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.6/10 (Category avg: 9.1/10)
- **File Analysis:** 9.6/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [ESET](https://www.g2.com/sellers/eset)
- **Company Website:** https://www.eset.com
- **Year Founded:** 1992
- **HQ Location:** Bratislava, Slovak Republic
- **Twitter:** @ESET (276,397 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/28967/ (1,944 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** IT Manager, Network Administrator
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 47% Mid-Market, 46% Small-Business


#### Pros & Cons

**Pros:**

- Ease of Use (95 reviews)
- Protection (79 reviews)
- Reliability (71 reviews)
- Security (64 reviews)
- Centralized Management (58 reviews)

**Cons:**

- Learning Curve (32 reviews)
- Difficult Configuration (31 reviews)
- Not User-Friendly (25 reviews)
- Lack of Clarity (23 reviews)
- Difficult Navigation (20 reviews)

  ### 2. [ANY.RUN Sandbox](https://www.g2.com/products/any-run-sandbox/reviews)
  ANY.RUN's Interactive Sandbox is a cloud-based service for in-depth malware analysis. It offers visibility into threat behavior based on interactivity that allows you to detonate threats, fine-tune analysis, and see the entire attack unfold with insights into related network activities, system processes, and TTPs in use. The environment is secure, configurable, and supports Windows, Linux, and Android. The sandbox provides SOC teams with a simple yet highly detailed way to break down cyber threats for fast decision making, investigation, and response.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 208

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 9.2/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.3/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.1/10 (Category avg: 9.1/10)
- **File Analysis:** 9.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [ANY.RUN](https://www.g2.com/sellers/any-run)
- **Company Website:** https://any.run/
- **Year Founded:** 2016
- **HQ Location:** Dubai, United Arab Emirates
- **Twitter:** @anyrun_app (32,590 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/30692044 (387 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Security Analyst, Cyber Security Analyst
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 31% Small-Business, 30% Enterprise


  ### 3. [Cloud-Delivered Security Services](https://www.g2.com/products/cloud-delivered-security-services/reviews)
  Overview Our Cloud-Delivered Security Services are natively integrated, offering consistent best-in-class protection everywhere. Backed by our world-renowned Unit 42® Threat Research team, this one-of-a-kind protection uses the network effect of 70,000+ global customers to share intelligence across all threat vectors to stop known, unknown and zero-day threats 180X faster than any other platform or point solution and prevent patient zero. What are Cloud-Delivered Security Services? A comprehensive suite of natively-integrated security services delivered from the cloud that provide protection for a customer’s entire network, securing all users, applications, devices, and data, regardless of the location. Our security services are powered by Precision AI™ and analyze real network traffic inline and stop threats in real time, including phishing, malware, command and control, ransomware, DNS-layered threats, and much more. These services include: Advanced Threat Prevention, the industry’s leading intrusion prevention system that addresses known and unknown command-and-control attacks from red team tools, as well as injection attacks and vulnerability exploits. Advanced WildFire, the industry’s largest malware analysis engine that stops the first instance of known, unknown and highly-evasive malware. Advanced URL Filtering, the industry’s first web security engine to stop unknown phishing attacks in real time. Advanced DNS Security, the industry’s most comprehensive DNS security solution that offers over 2x more threat coverage than the next leading security vendor and is also the industry’s first solution to stop network-based DNS hijacking attacks in real time. IoT/OT Security, the industry’s most comprehensive zero trust solution for IoT devices, helping you see and secure all connected devices in your network. NG-CASB, our SaaS application and data security solution that allows you to discover and control all of the SaaS consumption in your network. AI Access Security, our solution that ensures safe use of GenAI apps with access control, data protection and real-time visibility of over 600 applications, so that your employees can securely use AI to increase their productivity. With the power of AI and a robust global cloud infrastructure, Palo Alto Networks Cloud-Delivered Security Services can scale to stay ahead of today's threats and keep up with your organization's network security needs.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 101

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.8/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 8.8/10 (Category avg: 9.0/10)
- **Malware Detection:** 8.7/10 (Category avg: 9.1/10)
- **File Analysis:** 8.5/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Palo Alto Networks](https://www.g2.com/sellers/palo-alto-networks)
- **Year Founded:** 2005
- **HQ Location:** Santa Clara, CA
- **Twitter:** @PaloAltoNtwks (128,686 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/30086/ (21,355 employees on LinkedIn®)
- **Ownership:** NYSE: PANW

**Reviewer Demographics:**
  - **Who Uses This:** Network Engineer
  - **Top Industries:** Information Technology and Services, Computer & Network Security
  - **Company Size:** 41% Mid-Market, 34% Enterprise


  ### 4. [Coro Cybersecurity](https://www.g2.com/products/coro-cybersecurity/reviews)
  Coro is the easy cybersecurity company. We designed an all-in-one platform that every lean IT team will master. While other solutions scare people into buying complicated, confusing products, we lead with elegant simplicity. Coro is fast to deploy, easy to use, and designed not to waste your time. Once you install Coro, you’ll hardly think about us. That’s the point. Coro automatically detects and fixes security problems, so IT teams don’t have to spend time investigating or troubleshooting. We’re also one of the fastest-growing tech companies in North America, just ask Deloitte. Designed primarily for lean IT teams, Coro’s platform is particularly beneficial for organizations that may lack extensive IT resources or dedicated cybersecurity teams. With the increasing complexity of cyber threats, these businesses often find it challenging to maintain adequate security measures. Coro addresses this gap by automating the detection and remediation of security threats, allowing businesses to focus on their core operations without the constant worry of potential breaches or security incidents. One of Coro's key benefits is its intuitive, user-friendly interface, which simplifies the management of cybersecurity protocols. This ease of use is particularly advantageous for organizations with limited IT expertise, as it minimizes the need for extensive training or technical knowledge. Additionally, Coro’s continuous monitoring and reporting features provide businesses with valuable insights into their security posture, enabling them to make informed decisions about their cybersecurity strategies. Another impressive features is how comprehensive, yet powerful, it's all-in-one platform is. Using advanced AI technology, it detects and remediates over 92% of threats automatically, ensuring potential vulnerabilities are identified and addressed in real-time, significantly reducing the risk of data breaches and other cyber incidents. Their impressive performance has been recognised by G2 with a 94% approval rating from users and SE Labs, who awarded them three AAA ratings for their EDR, Email and Cloud modules. Overall, Coro’s cybersecurity platform represents a significant advancement in the field of cybersecurity. By automating threat detection and remediation, offering customizable solutions, and providing a user-friendly experience, Coro empowers organizations to effectively defend against the evolving landscape of cyber threats. Its recognition as one of the fastest-growing cybersecurity companies in North America further underscores its commitment to delivering innovative and effective security solutions.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 231

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 9.6/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.3/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.6/10 (Category avg: 9.1/10)
- **File Analysis:** 9.4/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Coronet](https://www.g2.com/sellers/coronet)
- **Company Website:** https://www.coro.net
- **Year Founded:** 2014
- **HQ Location:** Chicago, IL
- **Twitter:** @coro_cyber (1,892 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/coronet (295 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** IT Manager, IT Director
  - **Top Industries:** Non-Profit Organization Management, Financial Services
  - **Company Size:** 57% Mid-Market, 36% Small-Business


#### Pros & Cons

**Pros:**

- Ease of Use (99 reviews)
- Security (68 reviews)
- Customer Support (67 reviews)
- Protection (55 reviews)
- Easy Setup (49 reviews)

**Cons:**

- Performance Issues (32 reviews)
- Improvements Needed (20 reviews)
- False Positives (19 reviews)
- Inaccuracy (19 reviews)
- Limited Features (16 reviews)

  ### 5. [VirusTotal](https://www.g2.com/products/virustotal/reviews)
  VirusTotal is a free online service that analyzes files and URLs to detect malware and other malicious content. By aggregating results from over 70 antivirus scanners and URL/domain blocklisting services, it provides a comprehensive assessment of potential threats. Users can submit files up to 650 MB or URLs for scanning, receiving detailed reports that include detection rates from various security vendors, behavioral analysis, and metadata extraction. This collaborative approach enhances the detection of threats that individual antivirus solutions might miss. Key Features: - Multi-Engine Scanning: Utilizes over 70 antivirus engines to analyze files and URLs, offering a broad detection capability. - File and URL Analysis: Supports scanning of files up to 650 MB and URLs, providing flexibility in threat assessment. - API Integration: Offers an API for automated submissions and integration with other security tools, facilitating streamlined workflows. - Dynamic Analysis: Employs the Cuckoo sandbox for dynamic malware analysis, enabling in-depth examination of suspicious files. - Statistical Insights: Provides real-time statistics on scanned files and detected threats, aiding in trend analysis and threat intelligence. Primary Value: VirusTotal enhances cybersecurity by offering a centralized platform for comprehensive malware detection and analysis. It addresses the limitations of individual antivirus solutions by aggregating multiple detection engines, thereby reducing false negatives and improving threat identification. This service is invaluable for security professionals, researchers, and organizations seeking to bolster their threat intelligence, validate suspicious files or URLs, and respond swiftly to potential security incidents.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 33

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 8.9/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.3/10 (Category avg: 9.1/10)
- **File Analysis:** 9.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [VirusTotal](https://www.g2.com/sellers/virustotal)
- **Year Founded:** 2004
- **HQ Location:** Spain
- **Twitter:** @virustotal (32,676 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/3847700/ (74 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services
  - **Company Size:** 40% Small-Business, 31% Mid-Market


  ### 6. [Google VirusTotal](https://www.g2.com/products/google-virustotal/reviews)
  VirusTotal is a comprehensive online service that analyzes files and URLs to detect viruses, worms, trojans, and other malicious content. By aggregating results from over 70 antivirus scanners and URL/domain blacklisting services, it provides a thorough assessment of potential threats. Users can upload files up to 650 MB or submit URLs for scanning, receiving detailed reports on the safety of the content. This collaborative approach enhances the detection of malware and helps in identifying false positives. Key Features and Functionality: - Multi-Engine Scanning: Utilizes a vast array of antivirus engines to provide comprehensive threat detection. - Dynamic and Static Analysis: Employs both dynamic (behavioral) and static (code) analysis techniques to identify malicious behavior. - URL and Domain Analysis: Assesses the safety of URLs and domains, identifying potential phishing sites or malicious content. - API Access: Offers API integration for automated submissions and retrieval of analysis reports, facilitating seamless incorporation into security workflows. - Community Collaboration: Enables users to share insights, comments, and ratings, fostering a collaborative environment for threat intelligence. Primary Value and User Solutions: VirusTotal serves as a vital tool for individuals and organizations aiming to bolster their cybersecurity defenses. By providing a centralized platform for malware detection and analysis, it aids in the early identification of threats, reducing the risk of infection and data breaches. Security professionals leverage VirusTotal for incident response, threat hunting, and research, while developers use it to ensure their software is free from malicious code. The service's extensive database and collaborative features enhance situational awareness and contribute to a more secure digital environment.


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 13

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 6.7/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.2/10 (Category avg: 9.0/10)
- **Malware Detection:** 8.8/10 (Category avg: 9.1/10)
- **File Analysis:** 9.4/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Google](https://www.g2.com/sellers/google)
- **Year Founded:** 1998
- **HQ Location:** Mountain View, CA
- **Twitter:** @google (31,885,216 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/1441/ (336,169 employees on LinkedIn®)
- **Ownership:** NASDAQ:GOOG

**Reviewer Demographics:**
  - **Company Size:** 38% Small-Business, 31% Enterprise


  ### 7. [ReversingLabs](https://www.g2.com/products/reversinglabs/reviews)
  ReversingLabs is the trusted name in file and software security. We provide the modern cybersecurity platform to verify and deliver safe binaries. Trusted by the Fortune 500 and leading cybersecurity vendors, RL Spectra Core powers the software supply chain and file security insights, tracking over 422 billion searchable files with the ability to deconstruct full software binaries in seconds to minutes. Only ReversingLabs provides that final exam to determine whether a single file or full software binary presents a risk to your organization and your customers.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 10

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.9/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.4/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.0/10 (Category avg: 9.1/10)
- **File Analysis:** 8.8/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [ReversingLabs](https://www.g2.com/sellers/reversinglabs)
- **Year Founded:** 2009
- **HQ Location:** Cambridge, US
- **Twitter:** @ReversingLabs (6,986 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/reversinglabs/ (330 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 80% Small-Business, 10% Mid-Market


#### Pros & Cons

**Pros:**

- Accuracy of Information (2 reviews)
- Customer Support (2 reviews)
- Efficiency (2 reviews)
- Prioritization (2 reviews)
- Reliability (2 reviews)

**Cons:**

- Complex Querying (1 reviews)
- Confusing Interface (1 reviews)
- Navigation Issues (1 reviews)
- UX Improvement (1 reviews)

  ### 8. [Intezer](https://www.g2.com/products/intezer-intezer/reviews)
  Intezer automates the entire alert triage process, like an extension of your team handling Tier 1 SOC tasks for every alert at machine-speed. Intezer monitors incoming incidents from endpoint, reported phishing pipelines, or SIEM tools, then autonomously collects evidence, investigates, makes triage decisions, and escalates only the serious threats to your team for human intervention. Power your SOC with artificial intelligence that makes sure every alert is deeply analyzed (including every single artifact like files, URLs, endpoint memory, etc.), detecting malicious code in memory and other evasive threats. Fast set up and integrations with your SOC team's workflows (EDR, SOAR, SIEM, etc.) means Intezer's AI can immediately start filtering out false positives, giving you detailed analysis about every threat, and speeding up your incident response time. With Intezer: • Reduce Tier 1 escalation, sending only 4% of alerts on average to your team for immediate action. • Identify up to 97% of false positive alerts without taking any time from your analysts. • Reduce average triage time to 5 minutes or less, while giving your analysts deep context about every alert to prioritize critical treats and respond faster.


  **Average Rating:** 4.5/5.0
  **Total Reviews:** 187

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.6/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.3/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.6/10 (Category avg: 9.1/10)
- **File Analysis:** 9.4/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Intezer](https://www.g2.com/sellers/intezer)
- **Year Founded:** 2015
- **HQ Location:** New York
- **Twitter:** @IntezerLabs (10,225 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/10656303/ (88 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer, Student
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 54% Small-Business, 23% Mid-Market


#### Pros & Cons

**Pros:**

- Detection Accuracy (3 reviews)
- Ease of Use (3 reviews)
- Malware Protection (3 reviews)
- Security (3 reviews)
- Security Protection (3 reviews)

**Cons:**

- Complex Interface (2 reviews)
- Poor Interface Design (2 reviews)
- UX Improvement (2 reviews)
- Access Control (1 reviews)
- Data Privacy (1 reviews)

  ### 9. [Symantec Content Analysis and Sandboxing](https://www.g2.com/products/symantec-content-analysis-and-sandboxing/reviews)
  Detect and block advanced threats that elude traditional analysis with multiple-layer inspection and customizable sandboxing


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 29

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.7/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.7/10 (Category avg: 9.1/10)
- **File Analysis:** 9.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Broadcom](https://www.g2.com/sellers/broadcom-ab3091cd-4724-46a8-ac89-219d6bc8e166)
- **Year Founded:** 1991
- **HQ Location:** San Jose, CA
- **Twitter:** @broadcom (63,117 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/broadcom/ (55,707 employees on LinkedIn®)
- **Ownership:** NASDAQ: CA

**Reviewer Demographics:**
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 37% Enterprise, 37% Mid-Market


  ### 10. [Trend Micro Deep Discovery](https://www.g2.com/products/trend-micro-trend-micro-deep-discovery/reviews)
  Deep Discovery Inspector is available as a physical or virtual network appliance. It's designed to quickly detect advanced malware that typically bypasses traditional security defenses and exfiltrates sensitive data. Specialized detection engines and custom sandbox analysis detect and prevent breaches.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 16

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 9.2/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 8.8/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.4/10 (Category avg: 9.1/10)
- **File Analysis:** 9.0/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Trend Micro](https://www.g2.com/sellers/trend-micro)
- **Year Founded:** 1988
- **HQ Location:** Tokyo
- **LinkedIn® Page:** https://www.linkedin.com/company/4312/ (8,090 employees on LinkedIn®)
- **Ownership:** OTCMKTS:TMICY
- **Total Revenue (USD mm):** $1,515

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services
  - **Company Size:** 41% Mid-Market, 35% Enterprise


  ### 11. [FileWall for Microsoft 365](https://www.g2.com/products/filewall-for-microsoft-365/reviews)
  FileWall is a must-have native security solution for Microsoft 365 and provides the ultimate protection against file-based cyber-attacks for Microsoft 365 business applications. Leveraging odix’s patented Deep File Analysis (DFA) technology containing proprietary Content Disarm and Reconstruction (TrueCDR™) algorithms. The DFA process considers a file like an iceberg, often unassuming on the surface but looking deep down into what lies beneath the surface eliminating embedded malware in files where traditional legacy solutions fail to detect. FileWall complements Microsoft’s security products such as Exchange Online Protection (EOP) and Defender (formerly Advanced Threat Protection - ATP), providing effective, real-time protection against any unknown threat hidden in innocent-looking files from both external, and internal sources.


  **Average Rating:** 4.9/5.0
  **Total Reviews:** 15

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Detection:** 10.0/10 (Category avg: 9.1/10)
- **File Analysis:** 10.0/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [odix](https://www.g2.com/sellers/odix)
- **Year Founded:** 2012
- **HQ Location:** Rosh Haain, Israel
- **Twitter:** @odix (6 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/odixcdr/about (18 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services
  - **Company Size:** 90% Small-Business, 10% Mid-Market


  ### 12. [Threat Zone](https://www.g2.com/products/threat-zone/reviews)
  Threat.Zone is a a holistic malware platform that is hypervisor-based, automated and interactive tool for analyzing malware, so you can fight new generation malwares by conducting: Real-time behavioral analysis, Simulating potential threats in a controlled environment to identify malicious activities, Multi-OS sandboxes Code execution, Evasion techniques And many more features.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 19

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 9.6/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.0/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.0/10 (Category avg: 9.1/10)
- **File Analysis:** 9.2/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Malwation](https://www.g2.com/sellers/malwation)
- **Year Founded:** 2020
- **HQ Location:** Delaware, US
- **Twitter:** @malwation (1,026 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/malwation/ (13 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Computer & Network Security
  - **Company Size:** 50% Mid-Market, 35% Enterprise


  ### 13. [PT MultiScanner](https://www.g2.com/products/pt-multiscanner/reviews)
  PT MultiScanner is a multithreaded malware detection system designed to find threats with precision and speed by combining multiple anti-virus engines and supplementing them with other detection methods, including retrospective analysis of malicious files and reputation services.


  **Average Rating:** 4.5/5.0
  **Total Reviews:** 17

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.3/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.2/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.6/10 (Category avg: 9.1/10)
- **File Analysis:** 8.8/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Positive Technologies](https://www.g2.com/sellers/positive-technologies)
- **HQ Location:** N/A
- **Twitter:** @PTsecurity_UK (6 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/positivetechnologies/ (734 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 61% Small-Business, 22% Mid-Market


  ### 14. [Trellix Intelligent Virtual Execution (IVX)](https://www.g2.com/products/trellix-intelligent-virtual-execution-ivx/reviews)
  IVX is a signature-less, dynamic analysis engine that captures and confirms zero-day, and targeted APT attacks. IVX identifies attacks that evade traditional signature-based defenses by detonating suspicious files, web objects, URLs, and email attachments within a proprietary hypervisor instrumented for over 200 potential simultaneous executions. IVX accelerates incident response by enabling analysts to visualize how malware is behaving within the virtual image and securely interact with malware to test effectiveness of countermeasures. Available on prem or as a cloud-native service Trellix IVX delivers proven, flexible analysis capabilities wherever you need to quickly inspect and verdict potentially malicious content. SOC analysts can manually submit objects for inspection and insight. Or seamlessly integrate IVX with enterprise applications— built or bought—for continuous and frictionless protection.


  **Average Rating:** 3.8/5.0
  **Total Reviews:** 29

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 7.5/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 6.7/10 (Category avg: 9.0/10)
- **Malware Detection:** 7.9/10 (Category avg: 9.1/10)
- **File Analysis:** 6.7/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Trellix](https://www.g2.com/sellers/trellix)
- **Year Founded:** 2004
- **HQ Location:** Milpitas, CA
- **Twitter:** @Trellix (241,709 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/44195/ (811 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 43% Mid-Market, 37% Small-Business


#### Pros & Cons

**Pros:**

- Detection (8 reviews)
- Detection Efficiency (6 reviews)
- Ease of Use (6 reviews)
- Security (6 reviews)
- Cloud Integration (5 reviews)

**Cons:**

- Expensive (8 reviews)
- Pricing Issues (4 reviews)
- Learning Curve (3 reviews)
- Cloud Dependency (1 reviews)
- Compatibility Issues (1 reviews)

  ### 15. [OPSWAT Filescan](https://www.g2.com/products/opswat-filescan/reviews)
  OPSWAT Filescan is a comprehensive file scanning solution designed to detect and prevent threats in files before they reach your network. It utilizes advanced multi-scanning technology, combining multiple anti-malware engines to provide high detection rates and minimize false positives. This ensures that both known and unknown threats are identified effectively. Key Features and Functionality: - Multi-Scanning Technology: Integrates multiple anti-malware engines to enhance detection capabilities and reduce false positives. - Real-Time Scanning: Provides immediate analysis of files to detect threats before they can cause harm. - Flexible Deployment: Offers cloud-based and on-premises deployment options to suit various organizational needs. - Comprehensive File Support: Supports a wide range of file types, ensuring thorough scanning across different formats. - Scalability: Designed to handle high volumes of files, making it suitable for organizations of all sizes. Primary Value and Problem Solved: OPSWAT Filescan addresses the critical need for proactive threat detection in files, preventing malware and other malicious content from infiltrating networks. By leveraging multiple anti-malware engines, it significantly enhances detection rates and reduces the risk of false positives. This solution is particularly valuable for organizations seeking to strengthen their cybersecurity posture by ensuring that all files entering their systems are thoroughly scanned and verified as safe.


  **Average Rating:** 4.5/5.0
  **Total Reviews:** 52

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.8/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.1/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.6/10 (Category avg: 9.1/10)
- **File Analysis:** 9.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [OPSWAT](https://www.g2.com/sellers/opswat)
- **Company Website:** https://www.opswat.com
- **Year Founded:** 2002
- **HQ Location:** Tampa, Florida
- **Twitter:** @OPSWAT (7,234 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/opswat/ (1,124 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Marketing and Advertising
  - **Company Size:** 49% Small-Business, 34% Mid-Market


#### Pros & Cons

**Pros:**

- Speed (3 reviews)
- Cloud Integration (2 reviews)
- Features (2 reviews)
- Reliability (2 reviews)
- Security (2 reviews)

**Cons:**

- Complex Setup (2 reviews)
- Complexity (1 reviews)
- Difficult Learning (1 reviews)
- File Management (1 reviews)
- Integration Issues (1 reviews)

  ### 16. [Hybrid Analysis](https://www.g2.com/products/hybrid-analysis/reviews)
  Hybrid Analysis provides free malware analysis service for the community that detects and analyzes unknown threats


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 12

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.3/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.3/10 (Category avg: 9.1/10)
- **File Analysis:** 9.0/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Hybrid Analysis](https://www.g2.com/sellers/hybrid-analysis)
- **HQ Location:** N/A
- **Twitter:** @HybridAnalysis (10,732 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 50% Enterprise, 33% Mid-Market


  ### 17. [PolySwarm](https://www.g2.com/products/polyswarm/reviews)
  PolySwarm is a more effective way to detect, analyze and respond to the latest malware threats, the ones more likely to go undetected. PolySwarm is a launchpad for new and innovative threat detection methods, where commercial solutions and specialized engines compete with each other to detect threats, and get compensated based on their performance.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 13

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.8/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.4/10 (Category avg: 9.0/10)
- **Malware Detection:** 8.9/10 (Category avg: 9.1/10)
- **File Analysis:** 9.4/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [PolySwarm](https://www.g2.com/sellers/polyswarm)
- **Year Founded:** 2017
- **HQ Location:** San Diego, US
- **LinkedIn® Page:** https://www.linkedin.com/company/polyswarm/ (24 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 46% Small-Business, 38% Mid-Market


  ### 18. [Cuckoo Sandbox](https://www.g2.com/products/cuckoo-sandbox/reviews)
  Cuckoo Sandbox is the leading open source automated malware analysis system.You can throw any suspicious file at it and in a matter of minutes Cuckoo will provide a detailed report outlining the behavior of the file when executed inside a realistic but isolated environment.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 14

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 8.3/10 (Category avg: 9.0/10)
- **Malware Detection:** 8.3/10 (Category avg: 9.1/10)
- **File Analysis:** 8.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Cuckoo](https://www.g2.com/sellers/cuckoo)
- **Year Founded:** 2010
- **HQ Location:** N/A
- **Twitter:** @cuckoosandbox (13,711 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 57% Small-Business, 36% Mid-Market


  ### 19. [VIPRE Integrated Email Security](https://www.g2.com/products/vipre-integrated-email-security/reviews)
  Todays zero-day threats, polymorphic malware and weaponized attachments demand a sophisticated multi-layered approach to keep businesses safe. VIPRE Email Security and suite of add-on solutions, delivered from the convenience of cloud-based architecture, is the secure choice for todays pervasive email threats. Processing over 1.2 billion emails a month. 50,000+ customers and 4,000+ partner. - Anti-spam & Antivirus - Outbound Email Scanning - Email Replay 90 Days - Large Message Handling - Advanced Policies - Custom Policies - DLP - Spoofing Protection - End-User Spam Reports - LDAP Integration - Always-On Continuity - Email Link Isolation - Email Analytics - Attachment Sandboxing - Email Encryption - Remote Browser Isolation


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 34

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 7.6/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 10.0/10 (Category avg: 9.0/10)
- **Malware Detection:** 8.3/10 (Category avg: 9.1/10)
- **File Analysis:** 8.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [VIPRE Security](https://www.g2.com/sellers/vipre-security)
- **Company Website:** https://www.VIPRE.com
- **Year Founded:** 1994
- **HQ Location:** Clearwater, FL
- **Twitter:** @VIPRESecurity (8,305 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/11052300/ (234 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** IT Manager
  - **Top Industries:** Information Technology and Services
  - **Company Size:** 49% Mid-Market, 44% Small-Business


  ### 20. [VMRay](https://www.g2.com/products/vmray/reviews)
  Sandboxing reinvented against the threats of today - and tomorrow. At VMRay, our purpose is to liberate the world from undetectable digital threats. Led by reputable cyber security pioneers, we develop best-of-breed technologies to detect and analyze unknown, evasive, and sophisticated threats that others miss. We empower organizations to accelerate analysis and response, automate security tasks, and build their own threat intelligence by providing the world’s best detection and analysis platform for malware and phishing threats. \_\_\_ The target audience for VMRay encompasses a wide range of organizations, including enterprises such as top technology firms, banks and financial organizations, leading manufacturing companies, accounting and consulting firms, managed security service providers (MSSPs), and government entities. These users face the daunting challenge of safeguarding sensitive data against increasingly sophisticated cyber threats. VMRay's unique technologies, based on the world’s most advanced sandbox which employs a hypervisor-based approach, enables users to observe malicious samples in a completely invisible environment. This capability not only enhances the accuracy and depth of threat detection but also ensures that security teams can analyze threats without interference from evasive tactics employed by cyber threat actors. By meticulously sorting, filtering, and prioritizing results, VMRay delivers clear and actionable reports that eliminate the noise often associated with advanced threat analysis. This clarity is crucial for security teams, as it allows them to focus on the highest-priority insights without being overwhelmed by irrelevant data. Furthermore, VMRay's integration capabilities enable seamless integrations with existing security tools, such as Endpoint Detection and Response (EDR) systems, Security Orchestration, Automation, and Response (SOAR) platforms, and Threat Intelligence platforms enhancing overall operational efficiency of SOC and CTRI teams, incident responders and threat hunters. In addition to its technological prowess, VMRay places a strong emphasis on privacy and data control. Unlike many competitors, VMRay does not share customer analysis reports, indicators of compromise (IOCs), and any kind of data with third parties, ensuring that sensitive information remains confidential. Customers have the flexibility to choose their data hosting locations (in Germany and the USA) and durations, which is particularly beneficial for organizations that must comply with stringent privacy regulations. This commitment to privacy, combined with VMRay's innovative solutions, positions the company as a trusted partner for organizations seeking to bolster their cyber resilience and enhance SOC maturity. Ultimately, VMRay's dedication to continuous innovation, coupled with its focus on delivering reliable and clear threat analysis, makes it a formidable player in the malware analysis landscape. By addressing the complexities of modern cyber threats with precision and clarity, VMRay empowers organizations to navigate the challenges of cybersecurity with confidence, ensuring they are well-equipped to defend against both current and future threats.


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 7

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 8.7/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.0/10 (Category avg: 9.1/10)
- **File Analysis:** 8.7/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [VMRay](https://www.g2.com/sellers/vmray)
- **Company Website:** https://www.vmray.com
- **Year Founded:** 2013
- **HQ Location:** Bochum, DE
- **Twitter:** @vmray (4,080 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/vmray/ (115 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 86% Enterprise, 14% Small-Business


#### Pros & Cons

**Pros:**

- Automation (3 reviews)
- Customer Support (2 reviews)
- Ease of Use (2 reviews)
- Solutions (2 reviews)
- Threat Detection (2 reviews)

**Cons:**

- Difficult Learning Curve (1 reviews)
- Difficult Setup (1 reviews)
- Expensive (1 reviews)
- Poor Detection Performance (1 reviews)
- UX Improvement (1 reviews)

  ### 21. [BitNinja](https://www.g2.com/products/bitninja/reviews)
  State-of-the-art server security with an all-in-one platform BitNinja offers an advanced server security solution with a proactive and unified system designed to effectively defend against a wide range of malicious attacks. Breaking new ground, BitNinja will be the first server security tool that protects Windows servers. Main solutions: - Reduce the server load as a result of the real-time IP reputation, with a database of 100M+ IP addresses thanks to BitNinja’s Defense Network - Stop zero-day exploits with the WAF module, and BitNinja’s self-written rules - Remove malware quickly and prevent reinfections with the industry-leader malware scanner - Enable the AI Malware Scanner to remove malware than ever before - Identify possible backdoors in your system with the Defense Robot - Protect your server from brute-force attacks with the Log Analysis module that runs silently in the background - Regularly examine and clean your database with the Database Cleaner - Discover and eliminate vulnerabilities in your website at no additional cost with the SiteProtection module - Block spam accounts, prevent server blocklisting, and gain insights into outgoing spam emails with the Outbound - Spam Detection module powered by ChatGPT - Trap suspicious connections with Honeypots and block access through backdoors with the Web Honeypot BitNinja Security stops the latest attack types, including: - All types of malware - with the best malware scanner in the market - Brute-force attacks at both network and HTTP levels; - Vulnerability exploitation – CMS (WP/Drupal/Joomla) - SQL injection - XSS - Remote code execution - Zero-day attacks; - DoS (denial of service) attacks BitNinja Security makes it easy to secure web servers: - 1-line code installation - Fully automated operation keeps servers safe and eliminates human error - AI-powered community-driven worldwide Defense Network - Unified, intuitive Dashboard for your whole infrastructure - Easy server management with Cloud Configuration - Premium support with a maximum 5-min response time - The convenience of a robust CLI - API available for automation and reporting - Seamless integrations with a wide range of platforms like Enhance control panel, 360 Monitoring, and JetBackup. BitNinja is supported on THE PLATFORM and up, installed on the following Linux distributions: CentOS 7 and up 64 bit CloudLinux 7 and up 64 bit Debian 8 and up 64 bit Ubuntu 16.04 and up 64 bit RedHat 7 and up 64 bit AlmaLinux 8 64 bit VzLinux 7 and up 64 bit Rocky Linux 8 64 bit Amazon Linux 2 64 bit Windows 2012 RE and newer


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 20

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.9/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 6.7/10 (Category avg: 9.0/10)
- **Malware Detection:** 8.3/10 (Category avg: 9.1/10)
- **File Analysis:** 8.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [BitNinja Ltd.](https://www.g2.com/sellers/bitninja-ltd)
- **Year Founded:** 2014
- **HQ Location:** Debrecen
- **Twitter:** @bitninjaio (1,079 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/9343568/ (24 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Internet
  - **Company Size:** 88% Small-Business, 8% Mid-Market


  ### 22. [Emsisoft Business Security](https://www.g2.com/products/emsisoft-business-security/reviews)
  Emsisoft Business Security is a powerful Windows cybersecurity solution that protects small and medium sized businesses from online threats. Featuring a full suite of multi-layered real-time protection components - including behavioral analysis, machine learning and anti-ransomware technologies - Emsisoft Business Security provides complete protection from known and emerging threats.


  **Average Rating:** 4.8/5.0
  **Total Reviews:** 6

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.3/10 (Category avg: 9.0/10)
- **Malware Detection:** 10.0/10 (Category avg: 9.1/10)
- **File Analysis:** 9.3/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Emsisoft](https://www.g2.com/sellers/emsisoft)
- **Year Founded:** 2003
- **HQ Location:** Nelson,New Zealand
- **Twitter:** @emsisoft (6,046 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/2101680/ (21 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 67% Mid-Market, 50% Small-Business


  ### 23. [Remnux](https://www.g2.com/products/remnux/reviews)
  REMnux® is a Linux toolkit for reverse-engineering or otherwise examining malicious software. It provides a curated collection of free tools created by the community. Malware analysts can start using them without having to find, install, and configure them.


  **Average Rating:** 3.7/5.0
  **Total Reviews:** 6

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 5.0/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 9.4/10 (Category avg: 9.0/10)
- **Malware Detection:** 7.2/10 (Category avg: 9.1/10)
- **File Analysis:** 8.9/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Remnux](https://www.g2.com/sellers/remnux)
- **HQ Location:** N/A
- **Twitter:** @REMnux (6,404 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 100% Small-Business, 17% Mid-Market


  ### 24. [Joe Sandbox](https://www.g2.com/products/joe-sandbox/reviews)
  Joe Security specializes in the development of malware analysis systems for malware detection and forensics. Based on the idea of deep malware analysis & multi-technology platform, Joe Security has developed unique technologies to analyze malware in a depth previously not possible. Joe Security provides malware analysis systems as a cloud service or as a standalone software package on premise.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 5

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 8.3/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 10.0/10 (Category avg: 9.0/10)
- **Malware Detection:** 9.4/10 (Category avg: 9.1/10)
- **File Analysis:** 9.4/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [Joe Security](https://www.g2.com/sellers/joe-security)
- **Year Founded:** 2011
- **HQ Location:** Reinach, CH
- **Twitter:** @joe4security (7,601 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/joe-security-llc (13 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 60% Small-Business, 20% Mid-Market


  ### 25. [DeCYFIR by CYFIRMA](https://www.g2.com/products/decyfir-by-cyfirma/reviews)
  DeCYFIR is an AI-powered preemptive External Threat Landscape Management platform engineered to help organizations predict and prevent cyberattacks before they occur. Adopting a hacker's perspective, it delivers early warnings, prioritized insights, and actionable intelligence across the full external threat landscape. Built on a proprietary 9-pillar architecture — spanning Attack Surface Discovery & Intelligence, Vulnerability Intelligence & Threat Prioritization, Brand & Online Exposure Management, Digital Risk & Identity Protection, Third Party Risk Management, Situational Awareness & Emerging Threats, Predictive Threat Intelligence, Threat Adaptive Awareness & Training, and Sector Tailored Deception Intelligence. DeCYFIR correlates signals across all pillars to cut through noise, surface what is truly critical, and empower security teams to stay decisively ahead of emerging threats.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 23

**User Satisfaction Scores:**

- **Has the product been a good partner in doing business?:** 9.2/10 (Category avg: 8.8/10)
- **Malware Evaluation:** 10.0/10 (Category avg: 9.0/10)
- **Malware Detection:** 10.0/10 (Category avg: 9.1/10)
- **File Analysis:** 10.0/10 (Category avg: 9.0/10)


**Seller Details:**

- **Seller:** [CYFIRMA](https://www.g2.com/sellers/cyfirma)
- **Year Founded:** 2017
- **HQ Location:** Singapore, SG
- **Twitter:** @cyfirma (1,004 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/cyfirma/ (124 employees on LinkedIn®)
- **Phone:** marketing@cyfirma.com

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services
  - **Company Size:** 43% Small-Business, 35% Mid-Market


#### Pros & Cons

**Pros:**

- Threat Detection (12 reviews)
- Threat Intelligence (10 reviews)
- Cybersecurity (9 reviews)
- Features (7 reviews)
- Security (7 reviews)

**Cons:**

- Not User-Friendly (4 reviews)
- Complexity (3 reviews)
- Learning Curve (3 reviews)
- Limited Customization (3 reviews)
- Complex Setup (2 reviews)



## Parent Category

[System Security Software](https://www.g2.com/categories/system-security)




---

## Buyer Guide

### What You Should Know About Malware Analysis Tools

### What are Malware Analysis Tools?

Malware analysis tools help organizations detect and mitigate potential cyber threats. Malware is a malicious software that attacks and causes damage to programmable devices, servers, networks, and host systems. It can be of different varieties, such as ransomware, virus, spyware, and more. Malware analysis is the process that allows for easy identification of malware emergence, its purpose, and its impact on the organization’s IT assets, endpoints, and applications. It helps in tackling vulnerabilities on time and reduces threats to applications, websites, and servers.

Once a malware is detected in the system, cybersecurity experts typically collect a sample and analyze it in a sandboxed environment to understand its functionalities and the impact it can have on the company’s security infrastructure. The team then devises how the malware can be reverse engineered by testing its response to various countermeasures such as antivirus programs.

#### What Types of Malware Analysis Tools Exist?

Malware analysis tools can be categorized based on how the analysis is conducted. They will fall under one of the following types:

**Static malware analysis tools**

This type of tool examines a file without executing the code. Static analysis can easily be performed and helps derive static information associated with the files being examined, such as metadata, embedded resources, headers, and more. Certain technical parameters are used to identify if the file is harmful. Static analysis is not instrumental in detecting sophisticated malware as it does not run the program. It can, however, provide insights to identify where the security team should conduct their subsequent investigation. If the results of static malware analysis reveal no malicious intent, the code is usually discarded, and no further analysis is conducted to detect malware.

**Dynamic malware analysis tools**

Tools for conducting dynamic analysis execute suspicious codes in a secure environment known as a sandbox. They search through the codes of executable files to pull out specific suspicious actions. The sandbox helps simulate an entire host environment (memory, CPU, operating systems), allowing the security experts to constantly monitor the malware's capabilities without posing any threat to the organization’s security. It provides high-level insights to understand the nature of the malware and its impact. It also expedites the process of rediscovering a malicious file. 

**Hybrid malware analysis tools**

Static analysis does not help in detecting sophisticated malicious code. Sophisticated malware can sometimes go undetected, even with the application of sandbox technology. Hybrid tools offer a combination of both techniques. Hybrid analysis identifies risks even from the most sophisticated malware. It detects files hiding malicious codes and derives more indicators of compromise for more informed analysis.

**Forensic malware analysis tools**

Digital forensic analysts use these tools to examine a system post-compromise to identify malicious files, log changes, and suspicious activity. These tools are typically used after a malware attack for security teams to analyze the capability and effects of the malware and deal with it in the future. ** **

### What are the Common Features of Malware Analysis Tools?

The following are some core features within malware analysis tools that can help users in detecting potential cybersecurity threats:

**Malware identification:** Malware analysis tools have built-in capabilities to identify good and malicious code. They assist in the effective detection of vulnerabilities and threats. Threat actors are resorting to highly advanced techniques that make detecting an anomaly more difficult. Malware analysis tools provide behavioral analysis to identify malicious codes and suspicious activities. This includes analysis of activity logs, process monitoring, file system tracking, and more to assist in responding to threats efficiently. Additionally, malware analysis offers extraction of indicators of compromise (IoCs), which helps to identify future threats of the same nature.

**Threat alerts and triage:** These tools help security teams understand the pattern of malware threats and enable them to take corrective actions on time. They conduct an initial triage of malware samples and help malware analysts to discover suspicious artifacts for debugging and reverse engineering the malware. Malware analysis tools emphasize sending high-fidelity alerts that users can trust and act on. Therefore, security professionals can prevent time wastage and take prompt actions based on these alerts.

**Network activity monitoring:** Organizations can benefit from malware analysis tools that monitor endpoints and networks to detect suspicious files. The tools can record, filter, and analyze network traffic to help security operations teams understand the behavioral indicators of malware and how the malware impacts network traffic.

### What are the Benefits of Malware Analysis Tools?

Organizations can benefit from malware analysis tools in the following ways:

**Effective response to incidents:** Malware analysis tools allow security experts to efficiently respond to and contain incidents. By correctly analyzing with the help of these tools, responders can prevent the malicious code from causing massive damage to the organization and its sensitive data.

**In-depth analysis of suspicious activities:** The tools provide real-time insights into processes and file systems. They help incident responders and security analysts to collect, analyze and gain an in-depth understanding of the information from events and log files. This threat intelligence data can be gathered from firewalls, routers, network detection systems, and domain controllers. After performing deep analysis, these tools generate detailed reports in various formats to guide the team in determining the attacker’s motive and devise strategies for the containment and eradication of malware.

**Increased security:** Tools for malware analysis facilitate quick identification of threats in their systems and take corrective actions on time. This ensures the security of sensitive data and intellectual property from threat actors. Security teams also ensure safety by analyzing compiled code on different platforms such as Windows, macOS, and Linux using these tools.

### Who Uses Malware Analysis Tools?

**Incident response teams:** Cyber security incident response teams conduct digital forensics and malware analysis. Incident response teams conduct root cause analysis to understand how the malware can affect the organization. The team uses malware analysis tools for reverse engineering malware samples and extracting actionable threat intelligence that can be used as reference to identify suspicious files in the future.

**Malware researchers:** Industry or academic malware researchers use malware analysis solutions to enhance their knowledge of the latest techniques, maneuvers, and tools used by cyber attackers to disrupt the security thread of organizations.

### What are the Alternatives to Malware Analysis Tools?

Alternatives to malware analysis tools can replace this type of software, either partially or completely:

[Website security software](https://www.g2.com/categories/website-security): Website security software safeguards websites from cyber attacks, online threats, and adversaries. These tools offer attributes of [distributed denial of service (DDoS) protection software](https://www.g2.com/categories/ddos-protection), [content delivery networks (CDN)](https://www.g2.com/categories/content-delivery-network-cdn), and [web application firewalls (WAF)](https://www.g2.com/categories/web-application-firewall-waf) to provide all-around website protection. 

[Antivirus software](https://www.g2.com/categories/antivirus): It is a software that searches for, detects, debugs, and prevents malicious software from infecting the networks, virtual machines, systems, and devices. Malware detected by an antivirus includes viruses, worms, trojans, adware, etc.

#### Software Related to Malware Analysis Tools

Related solutions that can be used together with malware analysis tools include:

[Network sandboxing software](https://www.g2.com/categories/network-sandboxing): A network sandboxing software provides a secure and isolated environment for security analysts to monitor, analyze, identify, and eradicate suspicious files on the company’s network.

### Challenges with Malware Analysis Tools

While malware analysis tools provide numerous advantages to businesses across the globe, they pose certain challenges, as listed below, which organizations must take into account.

**Lack of integration, accuracy, and automation:** One of the core challenges with malware analysis tools is their lack of integration and automation of workflows. As a result, the process becomes error-prone and doesn’t yield productive results. Organizations can lose valuable time due to a lack of accuracy and faulty code analysis while investigating malicious software.

**Lack of expertise in the application of malware analysis tools:** Malware analysis demands accuracy and requires the staff to be properly trained for the execution of this job. It is often challenging to find professionals with the right skill set. Additionally, security teams are often short-staffed and overwhelmed by the increasing number of threats. As a result, they can investigate only a fraction of the total alerts generated.

### How to Buy Malware Analysis Tools

#### Requirements Gathering (RFI/RFP) for Malware Analysis Tools

Whether a company is looking to buy its first malware analysis tool or switching to a new solution—wherever a business is in its buying process, [g2.com](https://www.g2.com/categories/malware-analysis-tools) can help select the best tool to suit the organization’s requirements.

The organization’s security professionals team should think about the pain points and jot them down, and these should be used to help create a criteria checklist. The business pain points might be related to the functionalities the tool must have to meet expectations. Besides technical and performance considerations, the team must also take into account how the new solution can add value to the existing security stack of the company. The checklist is a detailed guide that includes security requirements, necessary and nice-to-have features, budget, number of users, integrations, cloud or on-premises solutions, etc.

Depending on the scope of the deployment, it might be helpful to produce a request for information (RFI), a one-page list with a few bullet points describing what is needed from the malware analysis tool.

#### Compare Malware Analysis Tools Products

**Create a long list**

Vendor evaluations are essential to the software buying process, from meeting the business functionality needs to implementation. It helps to prepare a consistent list of questions regarding specific requirements and concerns to ask each vendor. The buyer may choose between an open-source or a closed-source tool.

The malware analysis products should be evaluated based on the following major parameters:

**User-friendly interface** : Malware analysis is not an easy task. As such, the tools for this job should come with a couple of user-friendly features which make the job of malware analysts as easy as possible. The tools should provide easy-to-use customizable features to help them stay organized.

**Extensive library of malware variants:** It becomes imperative for the tool to have large threat repositories of malware samples to help in the easy identification of different kinds of malware that can infect the system. The tools used for malware analysis typically use signature-based detection, which scans the database for artifacts of known malware families. Malware can go undetected if there is no record of the same variant in the database.

**Automation:** Without automation capabilities, malware detection can become tedious and error-prone even as evasive and advanced malware are becoming more common. To ensure higher accuracy, it is desirable to have additional automation capabilities within the tool as compared to a regular malware analysis solution. The organization can benefit from tools that incorporate machine learning (ML) and artificial intelligence (AI) in malware detection and analysis. ML is not limited to signature-based analysis. Machine learning algorithms help in behavior-based malware detection through the evaluation of objects for malicious behavior by identifying patterns and trends.

**Create a short list**

From the long list of vendors, narrowing down the list of contenders is pragmatic. Buyers must read user reviews, view ratings on the [G2 Grid](https://www.g2.com/categories/malware-analysis-tools#grid) for the malware analysis software category and read useability ratings. Buyers can compare the features offered by different products, such as decompilation, disassembly, assembly, graphing, and scripting, along with various other features. It is also recommended to compare the pricing structure of various solutions to shorten the list to a handful of contenders.

**Conduct demos**

While extensive documentation and tutorials are available on vendor websites, it is beneficial to request the provider for a live demo to have a better understanding of their offering. During each demo, buyers must ask questions and get clarifications on different use cases to best evaluate how each vendor stacks up against the competition. 

#### Selection of Malware Analysis Tools

**Choose a selection team**

Before getting started, creating a winning team that will work together throughout the entire process, from identifying pain points to implementation, is essential. The selection team should consist of organization members with the right interest, skills, and time to participate in this process. A good starting point is to aim for three to five people who fill the required roles. This may include the primary decision maker, cyber security incident response professional, technical lead, and IT administrator. 

Users must make sure that the selection team takes productivity-driven data into account. The selection process should involve comparing notes, facts, and figures noted during the process, such as the availability of advanced capabilities, usability, and security features.

**Negotiation**

It is important to discuss with the vendor their pricing structure, subscription fees, and licensing costs. For instance, the vendor may be willing to give a discount for multi-year contracts or for recommending the tool to other users.

**Final**  **decision**

Selecting a vendor that has a strategy aligned with the company’s security objectives will accelerate growth. Before going all in, it is recommended to roll out a test run or pilot program to test adoption with a small sample size of users. If the tool is well used and received, the buyer can be confident that the selection is correct. If not, it might be time to evaluate other offerings.