Detonate vs ThreatLab

Detonate runs software dependencies in isolated micro-virtual machines and monitors their runtime behavior for software supply chain security. It accepts npm and PyPI packages, Maven artifacts, binaries, and Docker images, then records file access, network connections, DNS queries, and process execution. The product assigns benign, suspicious, or policy-violating verdicts and provides an event timeline. Decoy files such as fake SSH keys, cloud credentials, API tokens, and environment files can flag access attempts. A token-authenticated REST API supports artifact submission, status checks, verdicts, and reports for CI/CD deployment gates. The sandbox has no internet connection by default; outbound connections can be logged and optionally blocked. Described controls include Firecracker microVM and KVM hardware isolation, gVisor support, seccomp-BPF profiles, and read-only root filesystems with tmpfs overlays. Detonate supports API and web access, Linux, and self-hosted deployment. The Community plan is free and self-hosted, with 2 concurrent sandboxes and 200 API runs per month. Paid plans start at $4,990 a year; enterprise pricing starts at $14,990 a year.

ThreatLab has no write-up on Specifiction yet; its figures are above.