ANY.RUN

Spec sheet

What it does

ANY.RUN provides a cloud interactive sandbox for analyzing malware and phishing with live visibility into behavior.Read 14 Oct 2026 · any.run

Product

ANY.RUN provides interactive malware analysis and threat intelligence solutions for security teams.Read 29 Sep 2026 · any.run

Intended users

The Enterprise Suite is presented for SMBs, enterprise companies, MSSPs, and government agencies.Read 29 Sep 2026 · any.run

Trial

ANY.RUN advertises a 14-day free trial for SOC teams to try its products with premium features.Read 29 Sep 2026 · any.run

Integrations

Connectors are offered for Microsoft Defender, Microsoft Sentinel, OpenCTI, SentinelOne, Splunk SOAR, Splunk Enterprise, Cortex XSOAR, Elastic Security, FortiSIEM, FortiSOAR, Google SecOps, and IBM QRadar SOAR.Read 14 Oct 2026 · any.run

Security

ANY.RUN states that it has SOC 2 Type II compliance and supports SAML 2.0 single sign-on and configurable multi-factor authentication.Read 29 Sep 2026 · any.run

Support

The contact page lists [email protected] for technical support and [email protected] for sales, demo, and trial inquiries.Read 29 Sep 2026 · any.run

Headquarters

Dubai, United Arab EmiratesRead 23 Sep 2026 · any.run

Founded

2016Read 23 Sep 2026 · any.run

Analysis

Users can upload a file or submit a link to inspect sample behavior, indicators of compromise, tactics, techniques, and triggered detection rules.Read 29 Sep 2026 · any.run

Analysis speed

ANY.RUN says its virtual machines start in under 10 seconds and reports are ready in 40 seconds.Read 29 Sep 2026 · any.run

API and formats

ANY.RUN offers access through API and SDK and lists STIX/MISP support for integrations.Read 29 Sep 2026 · any.run

Behavior visibility

The product presents process trees, network activity, file activity, registry changes, screenshots, and extracted indicators.Read 14 Oct 2026 · gartner.com

Chrome extension

The Chrome extension submits files and URLs to the sandbox or Safebrowsing and can produce JSON, MISP, and HTML reports.Read 14 Oct 2026 · chromewebstore.google.com

Company founded

ANY.RUN’s company history dates the founding idea to 2016 and names Aleksey Lapshin as founder.Read 14 Oct 2026 · any.run

Company headquarters

The official site identifies ANYRUN-FZCO at Dubai Silicon Oasis, Dubai, United Arab Emirates.Read 14 Oct 2026 · any.run

Company history

ANY.RUN's about page says the idea for the product dates to 2016 and names Aleksey Lapshin as its founder.Read 29 Sep 2026 · any.run

Company scale

ANY.RUN says it serves organizations in 195 countries and has more than 150 professionals.Read 14 Oct 2026 · any.run

Company size

LinkedIn lists ANY.RUN as a privately held computer and network security company with 51–200 employees and headquarters in Dubai Silicon Oasis.Read 14 Oct 2026 · linkedin.com

Data formats

Integrations support STIX/TAXII and API/SDK delivery of structured threat data.Read 14 Oct 2026 · any.run

Interactive analysis

Users can control a virtual machine in the browser, click files, open archives, and browse websites during detonation.Read 14 Oct 2026 · any.run

Interactive sandbox

The sandbox runs in a browser and lets analysts interact with a virtual machine in real time.Read 29 Sep 2026 · any.run

Limit: access complaints

Trustpilot reviewers complain about business-email requirements and difficulty obtaining access for personal or hobby use.Read 14 Oct 2026 · uk.trustpilot.com

Limit: Gartner reviewers

Gartner’s displayed dislikes identify heavy free-tier restrictions and limited operating-system support.Read 14 Oct 2026 · gartner.com

Limit: interface and environments

G2 reviewers mention crowded displays on long analyses, slow startup or high resource use, sandbox-aware malware, and a desire for more OS/browser versions.Read 14 Oct 2026 · g2.com

Limit: performance and price complaints

A Trustpilot reviewer reports slow sessions expiring before analysis finishes, restrictive free file sizes, expensive paid features, and unhelpful support.Read 14 Oct 2026 · uk.trustpilot.com

Limit: privacy and free tier

G2 reviewers say the free tier exposes submissions publicly and restricts analysis time or advanced features.Read 14 Oct 2026 · g2.com

Notable limits

The Community plan allows a 60-second VM timeout and a maximum input file size of 16 MB.Read 29 Sep 2026 · any.run

Notable news: March 2026 release

A March 31, 2026 release added macOS analysis, Windows Server analysis, SSL decryption improvements, and more than 1,300 detections.Read 14 Oct 2026 · any.run

Operating systems

The sandbox supports Windows 7, 10, 11 and Server, macOS, Ubuntu/Debian Linux, and Android environments.Read 14 Oct 2026 · any.run

Outage status

IsDown reported ANY.RUN operational on October 13, 2026, with zero user reports in the preceding 24 hours and zero incidents recorded since December 2025.Read 14 Oct 2026 · isdown.app

Praise: Gartner reviewers

Gartner’s displayed likes emphasize realistic real-time interaction, efficient malware triage, readable behavioral evidence, and practical phishing or URL investigation.Read 14 Oct 2026 · gartner.com

Praise: interactive analysis

G2 reviewers repeatedly praise real-time VM interaction, visibility into processes and network activity, and quick suspicious-file investigation.Read 14 Oct 2026 · g2.com

Public API

ANY.RUN publishes REST API documentation for Sandbox, TI Lookup, and TI Feeds services.Read 14 Oct 2026 · github.com

Python SDK

The official Python SDK supports synchronous and asynchronous interfaces and Python 3.5 through 3.13 according to its project description.Read 14 Oct 2026 · pypi.org

Rating on Chrome Web Store

5 out of 5 from 2 ratingsRead 14 Oct 2026 · chromewebstore.google.com

Rating on G2

4.7 out of 5 from 219 reviewsRead 14 Oct 2026 · g2.com

Rating on Gartner Peer Insights

4.7 out of 5 from 0 reviewsRead 14 Oct 2026 · gartner.com

Rating on Trustpilot

2.6 out of 5 from 4 reviewsRead 14 Oct 2026 · uk.trustpilot.com

SDK capabilities

The SDK can submit files and URLs, monitor analysis progress, retrieve reports, manage tasks, query IOCs, run YARA searches, and access TI feeds.Read 14 Oct 2026 · github.com

SDK installation

The SDK is installable with pip as anyrun-sdk or from the GitHub source tree.Read 14 Oct 2026 · pypi.org

SDK licence

The public anyrun-sdk repository and PyPI package state an Apache 2.0 licence.Read 14 Oct 2026 · pypi.org

Security compliance

ANY.RUN states that it has achieved SOC 2 Type II compliance.Read 14 Oct 2026 · any.run

Self-hosting

ANY.RUN states that it is cloud based and does not currently provide an on-premises deployment.Read 14 Oct 2026 · any.run

Servers

ANY.RUN says its servers are located in Germany at a large European hosting provider.Read 14 Oct 2026 · any.run

SOC reporting

Enterprise features include actionable Tier 1 reports with verdicts and defense action plans.Read 14 Oct 2026 · any.run

Startup speed

ANY.RUN says its virtual machines start in under 10 seconds and reports arrive in about 40 seconds.Read 14 Oct 2026 · any.run

Supported environments

The sandbox supports Windows, macOS, Linux, and Android analysis environments, with availability varying by plan.Read 29 Sep 2026 · any.run

Threat intelligence

ANY.RUN says its threat intelligence uses data from millions of sandbox investigations into live malware and phishing threats.Read 29 Sep 2026 · any.run

Threat intelligence products

ANY.RUN lists three core products: Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds.Read 14 Oct 2026 · any.run

Plans and prices

Every ANY.RUN plan and price →

Where Specifiction places it

• Malware Analysis Sandboxes#1 of 279.1
• Sandbox Software#3 of 269.1