Best Malware Analysis Sandboxes in 2026
Updated
In short: ANY.RUN is ranked #1 of 24 as of 5 October 2026, ahead of Retrace and Malwagon. The best-ranked option with a free plan is Retrace. The lowest first paid tier on this page is Bitdefender Total Security at $5/mo.
Analyzing suspicious files and URLs calls for capabilities suited to the samples and investigations at hand. Compare deployment model and file size limit with URL analysis, network traffic analysis, and IOC extraction. API access and result retention add further points to examine, while free-plan availability and paid-from pricing help frame access and cost. ANY.RUN, Retrace, and Malwagon are among the options shown. Consider the kinds of samples you need to analyze and which listed analysis capabilities, deployment details, and result handling requirements fit your workflow.
24 malware analysis sandboxes ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
5 of the 24 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | ANY.RUNWeb · Windows · Mac · Linux · Android · iPhone · API | Three bars | — | 6 of 6 | Free | 6.7 | |
| 2 | RetraceWeb · Windows · Mac · Linux · Android · Self-hosted · API | Three bars | — | 5 of 6 | Free | 6.7 | |
| 3 | MalwagonWeb · Windows · Mac · Linux · API | Three bars | — | 4 of 6 | $79/mo | 6.6 | |
| 4 | CAPE SandboxWeb · Windows · Linux · Self-hosted · API | Three bars | — | 3 of 6 | Free | 6.5 | |
| 5 | Hybrid AnalysisWeb · API | Two bars | — | 1 of 6 | Free | 6.3 | |
| 6 | Bitdefender Total SecurityWindows · Mac · Android · iPhone | Two bars | — | — | 4 of 6 | $5/mo | 5.7 |
| 7 | Hatching TriageWeb · Windows · Mac · Linux · Android · Self-hosted · API | Two bars | — | — | 5 of 6 | — | 5.7 |
| 8 | ReversingLabs Cloud SandboxWeb · Windows · Mac · Linux · Android · API | Two bars | — | — | 5 of 6 | — | 5.7 |
| 9 | Zscaler Private AccessWeb · Windows · Mac · Linux · Android · iPhone | Two bars | — | — | 6 of 6 | — | 5.4 |
| 10 | CrowdStrike Falcon ProWeb · Windows · Mac · Linux · Android · iPhone · API | Two bars | — | — | 6 of 6 | $8.33/mo | 5.3 |
| 11 | FortiSandboxWeb · Self-hosted | One bar | — | — | 1 of 6 | — | 5.3 |
| 12 | SorbSecurity Cloud SandboxWeb · Windows · Android | One bar | — | — | 3 of 6 | — | 5.3 |
| 13 | Trellix Intelligent SandboxWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.3 |
| 14 | AppRemoverWindows | No signal | — | — | 1 of 6 | — | 5.2 |
| 15 | DetonateWeb · Linux | No signal | — | — | 2 of 6 | — | 5.2 |
| 16 | DRAKVUF SandboxWeb · Linux | No signal | — | — | 2 of 6 | — | 5.2 |
| 17 | Kaspersky Research SandboxWeb · Windows · Linux · Android · Self-hosted · API | Two bars | — | — | 4 of 6 | — | 5.2 |
| 18 | Symantec IT Management SuiteWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.1 |
| 19 | ThreatAnalyzerNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 20 | AhnLab V3 Internet SecurityWindows | One bar | — | — | 1 of 6 | — | 5.0 |
| 21 | Palo Alto Networks PanoramaWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 22 | VirusTotal IntelligenceWeb | No signal | — | — | 1 of 6 | — | 5.0 |
| 23 | CrowdStrike Falcon SandboxWeb | No signal | — | — | 1 of 6 | — | 4.8 |
| 24 | ThreatLabWeb · Windows | No signal | — | — | 2 of 6 | — | 4.8 |
Compare all 24 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | URL analysis | API access |
|---|---|---|---|---|---|---|---|---|
| 1 | ANY.RUN | 6.7 | Free plan | Free | Yes | — | Yes | Yes |
| 2 | Retrace | 6.7 | Free plan | Free | Yes | — | Yes | Yes |
| 3 | Malwagon | 6.6 | Free plan | $79/mo | Yes | 79 /mo | Yes | Yes |
| 4 | CAPE Sandbox | 6.5 | Free plan | Free | — | — | Yes | Yes |
| 5 | Hybrid Analysis | 6.3 | Free plan | Free | Yes | — | Yes | Yes |
| 6 | Bitdefender Total Security | 5.7 | No | $5/mo | No | — | Yes | Yes |
| 7 | Hatching Triage | 5.7 | No | — | Yes | — | Yes | Yes |
| 8 | ReversingLabs Cloud Sandbox | 5.7 | No | — | — | — | Yes | Yes |
| 9 | Zscaler Private Access | 5.4 | No | — | — | — | — | Yes |
| 10 | CrowdStrike Falcon Pro | 5.3 | No | $8.33/mo | No | — | Yes | Yes |
| 11 | FortiSandbox | 5.3 | No | — | — | — | — | Yes |
| 12 | SorbSecurity Cloud Sandbox | 5.3 | No | — | — | — | Yes | Yes |
| 13 | Trellix Intelligent Sandbox | 5.3 | No | — | — | — | Yes | Yes |
| 14 | AppRemover | 5.2 | No | — | — | — | Yes | Yes |
| 15 | Detonate | 5.2 | No | — | Yes | — | No | Yes |
| 16 | DRAKVUF Sandbox | 5.2 | No | — | — | — | No | Yes |
| 17 | Kaspersky Research Sandbox | 5.2 | No | — | No | — | Yes | Yes |
| 18 | Symantec IT Management Suite | 5.1 | No | — | — | — | — | — |
| 19 | ThreatAnalyzer | 5.1 | No | — | — | — | Yes | Yes |
| 20 | AhnLab V3 Internet Security | 5.0 | No | — | — | — | Yes | Yes |
| 21 | Palo Alto Networks Panorama | 5.0 | No | — | No | — | Yes | Yes |
| 22 | VirusTotal Intelligence | 5.0 | No | — | — | — | — | Yes |
| 23 | CrowdStrike Falcon Sandbox | 4.8 | No | — | No | — | Yes | Yes |
| 24 | ThreatLab | 4.8 | No | — | No | — | Yes | — |
Is your app on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which malware analysis sandboxe is ranked first on Freedom251?
ANY.RUN is ranked #1 of 24 with a score of 6.7. Retrace is second and Malwagon third.
How many of these have a free plan?
5 of the 24 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Bitdefender Total Security has the lowest first paid tier we found: $5/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation.