CyberIndexBeta

Product

Malware analysis sandbox that uses emulation-based dynamic analysis to detect evasive malware, combining static inspection of 120+ file types with behavioural analysis to extract indicators of compromise for SOC and threat-intelligence teams. Deployed as cloud SaaS, on-premises or air-gapped; integrates with SIEM, SOAR and threat-intelligence platforms. Supported platforms are Linux. It is available as a cloud instance. Recorded capabilities include behavioral detection, malware detection and sandbox analysis. The stated market is Enterprise and Government.

Current Version
3.3.0
Market
Critical InfrastructureEnterpriseGovernment
Licence
Paid
Price
Quote
Record Created
2026-09-22
Last Updated
2026-10-28

Vendor

OPSWAT sells to plant operators rather than households. Founded in 2002 by Benny Czarny, it built its business around a problem ordinary endpoint security does not address: files and removable media crossing into networks that cannot be patched, rebooted or taken offline — power, water, manufacturing, defence, air-gapped government systems — where the answer is to inspect and sanitise whatever crosses the boundary rather than to install an agent on the far side of it. Everything sits on the MetaDefender Platform. MetaDefender Core and MetaDefender ICAP Server scan files in transit using Metascan Multiscanning, which runs one file past many antivirus engines instead of trusting a single verdict, and Deep CDR, which rebuilds a document without its active content rather than judging whether that content is hostile. MetaDefender Kiosk scans removable media at a site entrance and MetaDefender Drive boots a machine to inspect it before it is admitted; MetaDefender Managed File Transfer carries what passes inward; MetaDefender Optical Diode and MetaDefender Unidirectional Security Gateway make a network link physically one-way. MetaDefender Network Access Control and MetaDefender Endpoint cover device posture. The company moved its headquarters to Tampa, Florida in 2023 and has grown partly by acquisition — Impulse (network access control, 2019), Fend (data diodes) and InQuest (file inspection and threat intelligence). OPSWAT also appears in this index as an assessor, not only as a vendor. The OPSWAT Certification column — Platinum down to Bronze — is its assessment of how well another company's antimalware product interoperates with the OESIS Framework, the component that access-control systems use to check what protection a device is running. A level shown in that column is OPSWAT's judgement of someone else's product, not of its own. Vendor page →

Website
opswat.com
Country
United States
Headquarters
Tampa, United States
Year Established
2002
Customers
2,100 organisations
Users
300M users
Revenue
$300.0M (2026)

Platforms

Cloudnative
Linuxnative

Target Market

Critical Infrastructure primaryEnterprise primaryGovernment secondary

Capabilities

Malware Detectionkeynative
Ransomware ProtectionkeyNot known
Behavioral Detectionkeynative
Web ProtectionkeyNot known
Email ProtectionNot known
Host FirewallNot known
Sandbox Analysisnative
Cloud-Assisted ScanningNot known
Heuristic DetectionNot known
Device ControlNot known
Vulnerability ShieldingNot known
Central Management ConsoleNot known

9 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 3.3.0Linuxreleased 2026-10-08

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

Not known

Change History

This record was created 2026-09-22. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 3.3.0 (Linux)evidence
  • 2026-10-18Product updatedSold to: Critical Infrastructureevidence
  • 2026-09-23Capability addedMalware Detection: built inevidence
  • 2026-09-23Capability addedBehavioral Detection: built inevidence
  • 2026-09-23Capability addedSandbox Analysis: built inevidence
  • 2026-09-22Pricing plan addedPrice: price on requestevidence
  • 2026-09-22New versionNew version: 3.2.0 (Linux)evidence
  • 2026-09-22Platform addedRuns on Cloudevidence
  • 2026-09-22Platform addedRuns on Linuxevidence
  • 2026-09-22Product updatedAlso sold to: Governmentevidence
  • 2026-09-22Product updatedSold to: Enterpriseevidence
  • 2026-09-22Product createdNew product, listed in Enterprise Antimalwareevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.