ThreatLab

Spec sheet

Purpose

ThreatLab is a local malware analysis sandbox for security teams, with analysis running on hardware they control.Read 7 Oct 2026 · threatlabsandbox.com

Trial

The maker offers a 30-day trial with full feature access and no credit card required; it says the license arrives by email within 12 hours.Read 7 Oct 2026 · threatlabsandbox.com

Maker

The site identifies the maker as BrightByte Labs LLC.Read 7 Oct 2026 · threatlabsandbox.com

AI integrations

Users can provide API keys from Anthropic, OpenAI, or Google for AI analysis; the page says keys are encrypted locally with AES-256-CBC.Read 7 Oct 2026 · threatlabsandbox.com

Data handling

The maker says samples are not uploaded and analysis runs locally on the user's hardware.Read 7 Oct 2026 · threatlabsandbox.com

Event log analysis

The built-in EVTX analyzer includes 2,900+ Sigma rules and supports timeline views, severity filtering, and CSV or JSON export.Read 7 Oct 2026 · threatlabsandbox.com

Interactive analysis

Its isolated Hyper-V sessions provide live desktop control, file and URL analysis, session recording, and save and resume.Read 7 Oct 2026 · threatlabsandbox.com

Management and support

A web management portal handles licenses, seat allocation, machine tracking, downloads, and documentation; the app also has issue reporting with optional log attachment.Read 7 Oct 2026 · threatlabsandbox.com

Monitoring

Sysmon monitoring captures process, network, file system, and registry events in real time.Read 7 Oct 2026 · threatlabsandbox.com

Reporting

It generates PDF reports with executive summaries, indicators of compromise, severity distribution, and technical details, with custom branding.Read 7 Oct 2026 · threatlabsandbox.com

Seat limits

A seat is one machine activation, and the maker says plans above 10 seats require contacting it for custom pricing.Read 7 Oct 2026 · threatlabsandbox.com

System requirements

The maker lists Windows 10/11 Pro or Enterprise 64-bit with Hyper-V, at least 16 GB RAM, 4 or more CPU threads with virtualization support, and 50 GB free disk space.Read 7 Oct 2026 · threatlabsandbox.com

Threat detection

The product includes DLL injection, credential access, scheduled task, service, ransomware canary, and certificate store monitoring.Read 7 Oct 2026 · threatlabsandbox.com

VPN

ThreatLab offers WireGuard VPN exit nodes in the US, UK, Germany, and Spain, with a kill switch that blocks internet access if the tunnel drops.Read 7 Oct 2026 · threatlabsandbox.com

Plans and prices

Every ThreatLab plan and price →

Where Specifiction places it

• Malware Analysis Sandboxes#13 of 277.5