ANY.RUN Sandbox Reviews & Product Details

I really enjoyed the interface of ANY.RUN Sandbox, which encouraged me to continue using it and incorporate it into our SOC workflow. Switching from a virtual sandbox, I appreciated the more in-depth analysis that ANY.RUN Sandbox provides, which stands out as a valuable feature. The setup process was straightforward and hassle-free, which was a significant advantage, and I would gladly repeat the process if necessary. ANY.RUN Sandbox significantly benefits my role by allowing me to efficiently investigate incidents and phishing emails with clarity and enhanced efficiency. I particularly like the different modes of investigation available, such as investigating URLs, files, and suspicious websites, which I can tailor to fit my workflow, ultimately improving my overall processes. The software’s efficiency, which allows me to carry out my work seamlessly, is a real selling point for me, and I would consider purchasing it again for this reason. Review collected by and hosted on G2.com.

I would make the user interface a little simpler as it is kind of complicated. Review collected by and hosted on G2.com.

I have been using ANY.RUN Sandbox for approximately two years, and I truly appreciate its intuitive interface, which makes it very straightforward to gain access to the tool and navigate through the features. The UI is straightforward, which makes my tasks easier and saves a lot of time, as it clearly guides how to submit files, emails, and URLs for analysis of potentially malicious content. The tool’s quick analysis capabilities are impressive, providing rapid and detailed assessments about whether something is malicious, which is crucial in my cybersecurity role. I particularly value the ability of the tool to dissect the entire lifecycle of a process, revealing network connections, HTTP requests, DNS requests, and providing detailed threat analysis. The AI-assessed summaries and IOC breakouts have been significantly beneficial from a business standpoint, offering detailed insights which enhance our forensic analysis and ability to respond quickly to cyber incidents. The setup process was pretty straightforward and I was able to quickly start using Any.Run. ANY.RUN Sandbox has proven to be very consistent in its usage compared to other options I considered, making it a reliable choice for conducting cybersecurity analysis. Additionally, its competitive pricing in the market adds to its value, making it a highly commendable tool. Overall, I rate it 10 out of 10 and have recommended it to many colleagues due to its comprehensive and easy-to-use features. Review collected by and hosted on G2.com.

I have not found any shortcomings with the product. Review collected by and hosted on G2.com.

Being able to observe malware behaviour in real time — file system changes, registry edits, network connections, process trees, and command execution — gives us a deeper understanding of threats targeting businesses in South Africa. Review collected by and hosted on G2.com.

The short session duration on the free plan can restrict deeper investigations, especially when dealing with malware that delays execution or requires multi-stage interaction. Review collected by and hosted on G2.com.

The file and URL inspection capabilities are excellent. Being able to immediately interact with a potentially malicious file or URL right in the platform is very helpful, and the ability for the platform to provide immediate feedback of analysis helps us identify threats quicker and deploy mitigations faster. The ability to extract threat related IOCs and implement their detection in our environment helps us anticipate and block threats quicker, and provide greater insight into the exact malicious activities files and URLs perform so we can be better prepared to defend against them. Review collected by and hosted on G2.com.

Only downsides are the limitations imposed on the use of the free version of the platform. Limiting malicious file analysis to 90 seconds and malicious URL analysis to five minutes can hamper investigations depending upon how long it takes for webpages to load, or how long it takes for a file to execute. I do appreciate the ability to extend the analysis time for live file analysis, but this can only be performed a limited amount of times, and overall analysis of files and URLs is limited to a few times a day. Review collected by and hosted on G2.com.

ANY.RUN stands out because of its real-time interactivity and user-friendly interface. I really appreciate how I can manually interact with malware during execution, check registry and file changes live, and download artifacts for deeper analysis. The visualization tools like network traffic flow and MITRE ATT&CK mapping also save a lot of time during investigations. Review collected by and hosted on G2.com.

Some advanced features are restricted in the free version, which limits deeper analysis in some cases. Also, the sandbox sometimes takes a little while to queue during high usage periods. More OS variety (like Android or Linux) would also be helpful for broader testing. Review collected by and hosted on G2.com.

A fast and reliable sandbox that supports multiple operating systems enables more effective analysis and troubleshooting. It also provides clear DNS flow visibility, making it easier to compare behaviors across different sandbox environments and improving overall detection accuracy. Review collected by and hosted on G2.com.

At the Sandbox level, unable to copy the IOCs because the URL automatically redirects, which disrupts the extraction process. Review collected by and hosted on G2.com.

ANY.RUN has honestly become one of my go-to tools whenever I’m dealing with suspicious files or trying to understand what a piece of malware is actually doing. The biggest advantage is how interactive it is. Instead of waiting for a sandbox to generate a static report, you can literally watch the malware run in real time—processes spawning, network traffic, file system changes, everything. Being able to pause, click around, and dig into specific behaviors makes the analysis process much smoother and a lot faster.

Another thing I really appreciate is how clean and easy the interface is. You don’t have to fight with the tool to get the information you need. Whether you’re doing quick triage or a deeper dive, it’s laid out in a way that just makes sense. The public submissions database is also incredibly useful. I’ve been able to look up similar samples, compare behaviors, and even confirm whether something I’m seeing matches known malware families.

Customer Service has been very good. They are quick to answer technical questions, and our account rep checks in with us regularly to go over new features and see how are liking the product. She is receptive to criticisms where warranted, and takes that information back to her development team.

Performance has been solid across the board. Sessions spin up quickly, results appear almost instantly, and the level of detail you get is more than enough for day-to-day analysis and threat hunting. Overall, ANY.RUN has saved me a lot of time and made malware analysis far less painful. If you work in a SOC, IR, or just want a reliable sandbox with great visibility, it’s absolutely worth using. Review collected by and hosted on G2.com.

The maximum file upload size is a burden, but there are workarounds. That really has been the only issue I have encountered. Review collected by and hosted on G2.com.

What I like best about ANY.RUN is how interactive and intuitive it is. Unlike traditional sandboxes, it lets me actively explore and analyze malware behavior in real time. I can easily follow network connections, file changes, and process actions without digging through logs. The visual interface makes complex data much more accessible. It feels like having a hands-on lab, but in the cloud. Review collected by and hosted on G2.com.

One thing I dislike about ANY.RUN is the limitation on analysis time and features in the free version—it can feel restrictive during deeper investigations. Sometimes, more advanced malware evades detection or doesn’t fully execute in the sandbox environment. I’ve also noticed occasional delays when the system is under heavy load. While the UI is generally great, certain areas could benefit from more customization. Still, these are relatively minor compared to its overall strengths. Review collected by and hosted on G2.com.

The existent-clip synergistic analysis is perfectly game-modified. Can supervise malware conduct measure-by-measure, track web connection, register changes, and register system adjustment. The envision procedure tree and elaborated account make it easy to understand even complex menace. To appreciate the velocity and simpleness of the interface. Review collected by and hosted on G2.com.

Sometimes the free level have limitations with runtime or register size‚ and certain advanced malware circumvent analysis by find the sandbox. It would be great if more OS option or furtive environment were add in the hereafter. Review collected by and hosted on G2.com.

Even with a free account, you can obtain impressive results. The platform is very user-friendly, and the reports it generates are excellent. It also allows you to download public malware samples. During analysis, you can extend the free analysis time from 60 seconds to 5 minutes directly from the user interface. Review collected by and hosted on G2.com.

They restrict Free mode analysis to Windows 10, even though the software actually supports multiple Windows versions, as well as Ubuntu and Debian Linux distributions, and Android 14. Review collected by and hosted on G2.com.