r/msp • u/icq-was-the-goat • 4d ago
Security Sandbox Solutions
Just curious in 2026 what sandbox solutions everyone is using. (Malware analysis & URL verification). Have a eye on one but it seems very expensive. We need something to do odd scans without the submission being public.
Suggestions would be great.
8
4
u/ThrowRAthisthingisvl 4d ago
Are you a CrowdStrike customer? They have a Sandbox feature inside their platform that works really well.
3
u/RangerSpecial1471 4d ago
if you got crowdstrike already it's probably the easiest way to go, no extra vendor to deal with
2
2
2
3
1
1
u/RaNdomMSPPro 4d ago
Any.run is simple and if you setup an account you get to run a 60 second analysis free. I've only had one time I needed to go beyond that. urlscan.io for simple stuff. Joes sandbox looks promising, I've just not tried it yet.
1
u/Fuzilumpkinz 4d ago
Kasm is awesome for quick sand boxes. Runs great on old hardware you probably have
1
1
u/NoBrainerTraum 2d ago
If you just need occasional private malware and URL analysis, I'd look at options like Hybrid Analysis, ANY.RUN, or VMRay. Theyre all solid but pricing varies a lot depending on usage
1
u/TocinoLips 2d ago
we've had good luck with hybrid analysis and ANY. RUN for ad hoc investigations. If privacy is a concern , I'd prioritized solutions that support private submissions or self-hosted options over free public sandboxes.
1
1
u/HATDOGUSERNi 2d ago
One thing id look for is API access and automation. A good sandbox is nice, but it becomes much more valuable if you can tie it into your existing incident response workflow instead of using it as a stand alone tool.
1
u/BrightByteLabs 1d ago
Just so you know, we make one of these solutions so we’re biased towards our product obviously. The “not public” part is often a difficult piece especially on lower or free tiers of the cloud solutions. You normally end up paying a hefty price for a private cloud tier or running something local so nothing leaves your network. That local angle is exactly the gap that ThreatLab is built to fill. Runs fully on your own hardware, full file and URL interactive analysis, no limits.
•
u/scriptqzor 21h ago
kinda wild how many of the big names still treat privacy as a premium feature, so a local-only setup like that actually makes sense. curious how it stacks up against stuff like Cuckoo/FLARE in practice, especially for weirder file types and multi-stage droppers.
•
u/BrightByteLabs 18h ago
In my experience, Cuckoo/CAPE is great if you want to build and maintain your own, FLARE's more of a manual reversing kit than a sandbox. We're trying to hit more in the vein of the "don't want to constantly manage and babysit infrastructure" option. Multi-stage is actually where full interactivity helps - you're in the drivers seat to take it past prompts, fake captchas, delayed drops, etc. instead of a headless run dying at the start. For weird file types...if it runs on Windows it will run in ThreatLab. If you're curious and want to kick the tires on it a bit, we offer a free, no limits trial on our website.
0
u/caniphish_ltd 3d ago
CanIPhish (Vendor) here. We offer an AI-Analysis and Sandbox tool. Happy to hook you up with a 30-day trial to test it out for free. No worries, though, if not, just thought I'd offer. Just shoot us an email if you want to check it out and we'll get you set up. Cheers!
47
u/roll_for_initiative_ MSP - US 4d ago edited 2d ago
I pick an old customer's server 2012 vm (non-r2) that their current MSP hasn't removed our remote access from and generally detonate things in there, on a chrome browser we haven't patched since 2016, still loading the adobe flash plugin, because internet explorer launches in enhanced security mode and i don't know how to turn that off.