ANY.RUN Sandbox Reviews & Product Details

If you’re new, you don’t need to be a hardcore reverser the platform walks you through, making it less intimidating Review collected by and hosted on G2.com.

Some phishing sites or advanced threats might not load properly in the sandbox, so you can’t always see exactly what a victim would Review collected by and hosted on G2.com.

What I like best about ANY.RUN Sandbox is its intuitive and interactive interface that allows real-time visibility into malware behavior, network activity, and process execution. It makes dynamic analysis fast, visual, and highly effective, enabling analysts to interact directly with samples and quickly identify threats. I also value how the platform promotes collaboration and knowledge sharing within the security community through public submissions and detailed reports, helping professionals stay ahead of emerging threats while improving productivity and learning. Review collected by and hosted on G2.com.

Some advanced features and longer analysis times are only available in the paid plans, which can limit deeper investigations for free users or can have a smoll paid plan.. poc 10 days. Review collected by and hosted on G2.com.

The ANY.RUN sandbox is easy to use. Simply upload your file and you can watch it run. Review collected by and hosted on G2.com.

The only thing I don't like about ANT.RUN is the public information. It would be nice if others didn't see my files. Review collected by and hosted on G2.com.

I love the fact that within minutes of receiving an alert, we can send a sample to Any.Run, and begin analyzing it. The process is easy, and gives a wealth of information and saves us the hassle of running our own lab to do the same work but at 3x the cost and time. Review collected by and hosted on G2.com.

The only downsides are the lack of mobile sandboxing simulation for malware just used on phones and tablets. Review collected by and hosted on G2.com.

The analysis of suspicious domains is very helpful, as it allows me to determine whether a domain appears unusual or legitimate. Any run is also really easy to use. I use ANY.RUN everytime I want to inspect a domain. Review collected by and hosted on G2.com.

The analysis process can be a bit slow at times, and occasionally, I notice that some suspicious websites redirect traffic to Google in order to bypass the sandbox. Review collected by and hosted on G2.com.

I like the ability to run in an isolated environment that helps determine if a file or site has malicious intent. It is very easy to navigate the menus to get things going. I have yet to try the paid version, luckily for us there are only a few occasions in a given month that I am asked to review a file or site. Review collected by and hosted on G2.com.

The time limit on the free account is a little too short, even though it can be extended. It's just a bit frustrating to have to reset it every few seconds, which takes away from what your trying to accomplish. Review collected by and hosted on G2.com.

I've both used and built a number of such sandboxes over my career. The Any.run sandbox offers a depth of analysis I have yet to find. Review collected by and hosted on G2.com.

Really, not much. As a cloud tool it is subject to all of the associated "someone else's computer" issues, but other than that it is wildly powerful and simple to use. Review collected by and hosted on G2.com.

Our team has been looking for a comprehensive sandboxing tool for a few years now, and after finding ANY.RUN and using their free plan for a little while, we picked up an Enterprise subscription and immediately noticed the benefits. Being able to run sandboxes for longer and the ability to make them private are two big standouts. Now we use ANY.RUN on a regular basis in our environment when analyzing websites and emails. All in all, a great tool. Highly recommend it. Review collected by and hosted on G2.com.

Their threat intelligence is still in its infancy. Best used in combination with other TI services. Review collected by and hosted on G2.com.

ANY.RUN is an outstanding sandbox platform that brings together all the tools needed for effective malware analysis. Its real-time interactive analysis capability sets it apart from traditional static solutions, allowing you to observe malware behavior as it unfolds.

The user interface is clean and intuitive, and the detailed reports are extremely valuable for both technical and non-technical users. Features like MITRE ATT&CK mapping, IOC extraction, network traffic inspection, and interactive command-line access make deep analysis straightforward and efficient.

It’s a reliable solution for anyone looking to investigate suspicious files, gather threat intelligence, or validate IOCs. I use it regularly and highly recommend it to colleagues in the cybersecurity field. Review collected by and hosted on G2.com.

While ANY.RUN offers a convenient and interactive environment for malware analysis, there are several areas where the platform could be improved.

The biggest downside is the limited system configuration flexibility—users cannot easily simulate more diverse environments (e.g., different OS builds, regional settings, or enterprise-like setups). Additionally, for advanced users, some of the network analysis capabilities feel too basic, and deeper packet inspection options are missing unless you upgrade.

Another concern is the pricing model. The free version is very limited, and the paid tiers can be expensive for small teams or individual researchers.

Overall, ANY.RUN is useful for quick analyses and educational purposes, but for more advanced, in-depth investigations, other solutions may offer better customization and depth. Review collected by and hosted on G2.com.

I really appreciate ANY.RUN’s interactive approach to sandboxing. Unlike traditional sandboxes that just give you static reports, ANY.RUN lets me actually interact with the environment in real time — clicking through windows, running commands, and observing live behavior. This makes it so much easier to track down malicious actions, registry changes, dropped files, and network connections. The intuitive visual process tree is also a huge plus for quickly understanding how malware executes. Review collected by and hosted on G2.com.

Overall, I’m very satisfied, but there are a few areas that could improve. Sometimes large or heavily obfuscated samples take longer to analyze, which slows down workflows. I’d also like to see deeper integrations with more threat intelligence feeds or automatic enrichment to speed up investigations even more. Lastly, while the UI is very user-friendly, advanced users might want even more granular control over the sandbox environment and simulation settings. Review collected by and hosted on G2.com.