CyberIndexBeta

Product

MetaDefender Managed File Transfer is a self-hosted MFT server for Windows Server that moves files between users, MFT instances and SMB, SFTP and SharePoint Online locations through uploads, shares and scheduled push and pull jobs. Before files are released they pass through OPSWAT’s MetaDefender scanning, content disarm and DLP engines (licensed through MetaDefender Core), and supervisor approval steps can be added. Supported platforms are Windows Server. Delivery is Hybrid and on-premises software. It is recorded as supporting ad-hoc secure sharing, API integration, browser transfer client and cloud storage connectors. Its record also notes Content Disarm & Reconstruction, DLP integration, encryption at rest and File-based Vulnerability assessment.

Current Version
3.11.6
Market
Critical InfrastructureEnterpriseGovernment
Licence
Paid
Price
Paid · price unknown
Record Created
2026-10-07
Last Updated
2026-10-28

Vendor

OPSWAT sells to plant operators rather than households. Founded in 2002 by Benny Czarny, it built its business around a problem ordinary endpoint security does not address: files and removable media crossing into networks that cannot be patched, rebooted or taken offline — power, water, manufacturing, defence, air-gapped government systems — where the answer is to inspect and sanitise whatever crosses the boundary rather than to install an agent on the far side of it. Everything sits on the MetaDefender Platform. MetaDefender Core and MetaDefender ICAP Server scan files in transit using Metascan Multiscanning, which runs one file past many antivirus engines instead of trusting a single verdict, and Deep CDR, which rebuilds a document without its active content rather than judging whether that content is hostile. MetaDefender Kiosk scans removable media at a site entrance and MetaDefender Drive boots a machine to inspect it before it is admitted; MetaDefender Managed File Transfer carries what passes inward; MetaDefender Optical Diode and MetaDefender Unidirectional Security Gateway make a network link physically one-way. MetaDefender Network Access Control and MetaDefender Endpoint cover device posture. The company moved its headquarters to Tampa, Florida in 2023 and has grown partly by acquisition — Impulse (network access control, 2019), Fend (data diodes) and InQuest (file inspection and threat intelligence). OPSWAT also appears in this index as an assessor, not only as a vendor. The OPSWAT Certification column — Platinum down to Bronze — is its assessment of how well another company's antimalware product interoperates with the OESIS Framework, the component that access-control systems use to check what protection a device is running. A level shown in that column is OPSWAT's judgement of someone else's product, not of its own. Vendor page →

Website
opswat.com
Country
United States
Headquarters
Tampa, United States
Year Established
2002
Customers
2,100 organisations
Users
300M users
Revenue
$300.0M (2026)

Platforms

Windows Servernative

Target Market

Critical Infrastructure primaryEnterprise primaryGovernment primary

Capabilities

SFTPkeynative
FTPSnative
AS2 (B2B EDI)keyNot known
SMB / CIFS File Sharesnative
NFSnative
Browser Transfer Clientnative
Ad-hoc Secure Sharingkeynative
Workflow Automationkeynative
Cloud Storage Connectorspartial
API Integrationnative
Encryption at Restkeynative
OpenPGP EncryptionNot known
Malware Scanning of Transferskeynative
Multi-Engine Scanningnative
Content Disarm & Reconstructionkeynative
DLP Integrationkeynative
Sandbox Analysiskeynative
Threat Intelligencenative
File-Based Vulnerability Assessmentnative
File Structure Validationnative
ICAP / Gateway Integrationnative
Tamper-Evident Audit Trailkeynative
SSO / MFAnative
SIEM Integrationnative
High Availabilitykeynative
Multi-Tenant (MSP) Managementnative

2 of 26 not yet known — not recorded, which is not the same as not supported.

Specifications

Scanning Engines30+ engines

Pricing

PlanLicencePriced perBilledPrice
PaidPaidnot statedyearlyNot known

Versions

  • 3.11.6platform not recordedreleased 2026-10-09

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

FIPS 140-3Level 11 activeFIPS 140-3 #5225

Change History

This record was created 2026-10-07. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 3.11.6evidence
  • 2026-10-19Product updatedSold to: Governmentevidence
  • 2026-10-18Product updatedSold to: Enterpriseevidence
  • 2026-10-15Pricing plan addedPrice: Paid — paidevidence
  • 2026-10-12Certification addedCertified: FIPS 140-3evidence
  • 2026-10-09Capability addedMulti-Engine Scanning: built inevidence
  • 2026-10-09Capability addedFile Structure Validation: built inevidence
  • 2026-10-09Capability addedFile-Based Vulnerability Assessment: built inevidence
  • 2026-10-09Capability addedThreat Intelligence: built inevidence
  • 2026-10-09Capability addedSandbox Analysis: built inevidence
  • 2026-10-08New versionNew version: 3.11.5evidence
  • 2026-10-08Capability addedNFS: built inevidence
  • 2026-10-08Capability addedSMB / CIFS File Shares: built inevidence
  • 2026-10-08Capability addedFTPS: built inevidence
  • 2026-10-08Capability addedSMB / CIFS File Shares: built inevidence
  • 2026-10-07Capability addedTamper-Evident Audit Trail: built inevidence
  • 2026-10-07Capability addedICAP / Gateway Integration: built inevidence
  • 2026-10-07Capability addedMulti-Tenant (MSP) Management: built inevidence
  • 2026-10-07Capability addedSFTP: built inevidence
  • 2026-10-07Certification addedCertified: FIPS 140-3 (Level 1)evidence
  • 2026-10-07Capability addedHigh Availability: built inevidence
  • 2026-10-07Capability addedSIEM Integration: built inevidence
  • 2026-10-07Capability addedSSO / MFA: built inevidence
  • 2026-10-07Capability addedDLP Integration: built inevidence
  • 2026-10-07Capability addedContent Disarm & Reconstruction: built inevidence
  • 2026-10-07Capability addedMalware Scanning of Transfers: built inevidence
  • 2026-10-07Capability addedEncryption at Rest: built inevidence
  • 2026-10-07Capability addedAPI Integration: built inevidence
  • 2026-10-07Capability addedCloud Storage Connectors: limitedevidence
  • 2026-10-07Capability addedWorkflow Automation: built inevidence
  • 2026-10-07Capability addedAd-hoc Secure Sharing: built inevidence
  • 2026-10-07Capability addedBrowser Transfer Client: built inevidence
  • 2026-10-07Capability addedSFTP: limitedevidence
  • 2026-10-07Platform addedRuns on Windows Serverevidence
  • 2026-10-07Product updatedSold to: Critical Infrastructureevidence
  • 2026-10-07Product createdNew product, listed in Managed File Transferevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.