CyberIndexBeta

Product

OPSWAT's file-security platform: every file that enters an organisation is passed through layered detection before it is allowed to execute. Metascan Multiscanning runs it past more than 30 anti-malware engines at once rather than trusting a single verdict; Deep CDR rebuilds documents without their active content across 200+ file types; Proactive DLP classifies and redacts sensitive data; and Adaptive Sandbox, Predictive AI and file-based vulnerability assessment cover what signatures miss. Deployed as a virtual machine, a Kubernetes-ready container, a managed cloud service or a distributed cluster, including in air-gapped environments, and integrated through its API rather than installed on endpoints. It runs on Linux and Windows Server. It is recorded as supporting api integration, archive extraction, behavioral detection and central management console. Its record also notes content disarm & reconstruction, content protection, dlp integration and file-based vulnerability assessment. The stated market is Critical Infrastructure, Enterprise and Government.

Current Version
5.23.0
Market
Critical InfrastructureEnterpriseGovernment
Licence
Paid
Price
Quote
Record Created
2026-09-24
Last Updated
2026-10-18

Vendor

OPSWAT sells to plant operators rather than households. Founded in 2002 by Benny Czarny, it built its business around a problem ordinary endpoint security does not address: files and removable media crossing into networks that cannot be patched, rebooted or taken offline — power, water, manufacturing, defence, air-gapped government systems — where the answer is to inspect and sanitise whatever crosses the boundary rather than to install an agent on the far side of it. Everything sits on the MetaDefender Platform. MetaDefender Core and MetaDefender ICAP Server scan files in transit using Metascan Multiscanning, which runs one file past many antivirus engines instead of trusting a single verdict, and Deep CDR, which rebuilds a document without its active content rather than judging whether that content is hostile. MetaDefender Kiosk scans removable media at a site entrance and MetaDefender Drive boots a machine to inspect it before it is admitted; MetaDefender Managed File Transfer carries what passes inward; MetaDefender Optical Diode and MetaDefender Unidirectional Security Gateway make a network link physically one-way. MetaDefender Network Access Control and MetaDefender Endpoint cover device posture. The company moved its headquarters to Tampa, Florida in 2023 and has grown partly by acquisition — Impulse (network access control, 2019), Fend (data diodes) and InQuest (file inspection and threat intelligence). OPSWAT also appears in this index as an assessor, not only as a vendor. The OPSWAT Certification column — Platinum down to Bronze — is its assessment of how well another company's antimalware product interoperates with the OESIS Framework, the component that access-control systems use to check what protection a device is running. A level shown in that column is OPSWAT's judgement of someone else's product, not of its own. Vendor page →

Website
opswat.com
Country
United States
Headquarters
Tampa, United States
Year Established
2002
Customers
2,100 organisations
Users
300M users
Revenue
$300.0M (2026)

Platforms

Cloudnative
Containernative
Linuxnative
Windows Servernative

Target Market

Critical Infrastructure secondaryEnterprise primaryGovernment secondary

Capabilities

Multi-Engine Scanningkeynative
Archive Extractionkeynative
True File Type Verificationkeynative
Password-Protected Archive HandlingNot known
Hash Reputation Lookupnative
Content Disarm & Reconstructionkeynative
Sandbox Analysisnative
Threat Intelligencenative
File-Based Vulnerability Assessmentnative
File Structure Validationnative
DLP Integrationnative
API Integrationkeynative
ICAP / Gateway Integrationkeynative
Object Storage Scanningkeyintegrated
Managed Upload PortalNot known
Central Management Consolenative

2 of 16 not yet known — not recorded, which is not the same as not supported.

Specifications

Scanning Engines30+ engines
Scanning Engines UsedNot known
File Types Supported200+ file types

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 5.23.0platform not recordedreleased 2026-10-05

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

Common CriteriaEAL41 active1 expiredshow 2 certificates ▾
FIPS 140-31 activeFIPS 140-3 #5225

Change History

This record was created 2026-09-24. Everything below is what has changed since.

  • 2026-10-15New versionNew version: 5.23.0evidence
  • 2026-10-12Certification addedCertified: FIPS 140-3evidence
  • 2026-10-10Capability addedObject Storage Scanning: integratedevidence
  • 2026-10-10Capability addedHash Reputation Lookup: built inevidence
  • 2026-10-10Capability addedCentral Management Console: built inevidence
  • 2026-10-09Capability addedFile Structure Validation: built inevidence
  • 2026-10-09Capability addedFile-Based Vulnerability Assessment: built inevidence
  • 2026-10-09Capability addedThreat Intelligence: built inevidence
  • 2026-10-09Capability addedDLP Integration: built inevidence
  • 2026-10-06Certification addedCertification expired: Common Criteria (EAL2)evidence
  • 2026-10-06Certification addedCertified: Common Criteria (EAL4)evidence
  • 2026-10-05Product updatedListed in Malware File Scannerevidence
  • 2026-10-05Capability addedICAP / Gateway Integration: built inevidence
  • 2026-10-05Capability addedAPI Integration: built inevidence
  • 2026-10-05Capability addedTrue File Type Verification: built inevidence
  • 2026-10-05Capability addedArchive Extraction: built inevidence
  • 2026-10-05Capability addedContent Disarm & Reconstruction: built inevidence
  • 2026-10-05Capability addedMulti-Engine Scanning: built inevidence
  • 2026-09-24New versionNew version: 5.22.1evidence
  • 2026-09-24Capability addedHeuristic Detection: built inevidence
  • 2026-09-24Capability addedBehavioral Detection: built inevidence
  • 2026-09-24Capability addedSandbox Analysis: built inevidence
  • 2026-09-24Capability addedContent Protection: built inevidence
  • 2026-09-24Capability addedMalware Detection: built inevidence
  • 2026-09-24Pricing plan addedPrice: price on requestevidence
  • 2026-09-24Platform addedRuns on Windows Serverevidence
  • 2026-09-24Product updatedAlso sold to: Governmentevidence
  • 2026-09-24Product updatedAlso sold to: Critical Infrastructureevidence
  • 2026-09-24Product updatedSold to: Enterpriseevidence
  • 2026-09-24Platform addedRuns on Cloudevidence
  • 2026-09-24Platform addedRuns on Containerevidence
  • 2026-09-24Platform addedRuns on Linuxevidence
  • 2026-09-24Product createdNew product, listed in Enterprise Antimalwareevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.