Skip to content
SPECIFICTION
Get listed

Kaspersky Research Sandbox

kaspersky.com

WebWindowsLinuxAndroidAPISelf-hosted
Visit kaspersky.com
Spec score 7.3 #15 of 27 in Malware Analysis Sandboxes

What it is

Kaspersky Research Sandbox analyzes suspicious objects to investigate their origins, collect behavior-based indicators of compromise, and detect previously unseen malicious objects. It is intended for security teams and threat researchers, with cloud and on-premise deployment options, including secure air-gapped environments. Its behavioral analysis uses extended logging and detailed reporting to expose file activity, while Kaspersky malware behavior knowledge is used to help keep the sandbox environment undetected. Teams can tailor guest operating system images to resemble their environments. Version 3.0 adds VNC interaction, allowing analysts to interact with a sample while it runs, and incorporates Microsoft AMSI output to improve detection of packed or obfuscated scripts, including PowerShell activity. Static analysis examines strings, headers, sections, import and export tables, and entropy graphs; it can analyze operating systems such as macOS that are not supported for dynamic analysis. An API accepts suspicious files and can export results to a SOC task management system. Integration with Kaspersky Private Security Network is also available. Pricing is on request, and there is no free plan.

Spec sheet

Purpose
Analyzes suspicious objects to investigate their origins, collect behavior-based IOCs, and detect previously unseen malicious objects.Read 4 Oct 2026 · kaspersky.com
Intended users
Kaspersky describes version 3.0 as designed for security teams and threat researchers.Read 4 Oct 2026 · kaspersky.com
Deployment
Available in cloud and on-premise deployment models, including secure air-gapped environments.Read 4 Oct 2026 · kaspersky.com
Integrations
The product has an API for sending suspicious files for analysis and exporting results to a SOC task management system, and it can integrate with Kaspersky Private Security Network.Read 4 Oct 2026 · kaspersky.com
Founded
1997Read 28 Sep 2026 · kaspersky.com
Company
Kaspersky is a global cybersecurity and digital privacy company founded in 1997.Read 4 Oct 2026 · kaspersky.com
Anti-evasion
The sandbox uses Kaspersky’s malware behavior knowledge to help keep the sandboxing environment undetected.Read 4 Oct 2026 · kaspersky.com
Behavior analysis
Patented behavioral analysis uses extended logging and in-depth reporting to expose malicious file behavior.Read 4 Oct 2026 · kaspersky.com
Custom images
Guest OS images can be customized to resemble an organization’s environment and improve threat analysis accuracy.Read 4 Oct 2026 · kaspersky.com
Interactive analysis
Version 3.0 adds VNC visual interaction so analysts can interact with a sample’s execution environment in real time.Read 4 Oct 2026 · kaspersky.com
Script analysis
Version 3.0 incorporates Microsoft AMSI output to improve detection of packed and obfuscated scripts, including PowerShell activity.Read 4 Oct 2026 · kaspersky.com
Static analysis
Extended static analysis examines file attributes such as strings, headers, sections, import and export tables, and entropy graphs, including for operating systems not supported for dynamic analysis such as macOS.Read 4 Oct 2026 · kaspersky.com
Supported environments
Kaspersky states that the sandbox supports Android OS, and describes configuring Windows guest images; its 3.0 announcement mentions macOS support for static analysis rather than dynamic analysis.Read 4 Oct 2026 · kaspersky.com

Plans and prices

Kaspersky Research Sandbox Priced on request Cloud or on-premise deployment · air-gapped environments supported Read 4 Oct 2026 · kaspersky.com

Every Kaspersky Research Sandbox plan and price →

Strong points and limits

Strong points

  • Available on-premise, in cloud, and in air-gapped environments.
  • Custom guest OS images can resemble an organization's environment.
  • VNC enables real-time interaction with sample execution.
  • Static analysis includes macOS, without dynamic analysis support.
  • API supports file submission and results export.

Limits

  • There is no free plan.
  • Pricing is available on request.
  • macOS is noted for static, not dynamic, analysis.

Who it suits

It suits security teams and threat researchers investigating suspicious files and other objects. Cloud, on-premise, and air-gapped deployment options accommodate different deployment environments.

Verdict

The sandbox combines behavioral and static analysis with deployment choices that include air-gapped environments. Pricing is not public, so teams must request it from Kaspersky.

Where Specifiction places it

Alternatives to Kaspersky Research SandboxAll alternatives →