MetaDefender Reviews

In my organization, I use MetaDefender for scanning incoming and outgoing files for any malicious content, and if any malicious content is found, then I filter it out using this tool.

While I was working with the bank, there are multiple vendors or partners who were sending and receiving files to and from the bank, and few files are coming from outside of the organization. We had a doubt that if any outsider sends files to us and if it is malicious, then it can create an issue on the server. So, we implemented MetaDefender for scanning all incoming and outgoing files and in that, in a month, we scanned over 10 million files and we found out of those, around 60 files were found malicious.

MetaDefender is a useful tool for scanning all incoming and outgoing files and keeping our applications and servers in compliance, and I found it useful because we can integrate it with multiple file transfer tools such as Globalscape EFT, GoAnywhere, or Sterling, which is the best feature as it integrates with multiple tools.

I transfer around millions of files in my organization, one million files daily, and while we implemented scanning with MetaDefender, we found out that every day we are transferring one or two malicious files, which were filtered out and relevant stakeholders were notified. They corrected it and we sent it to the security team who analyzed it, further helping us keep our systems clean.

MetaDefender offers multiple features. Multi-scanning technology allows you to use simultaneous scanning anti-malware scanning engines to detect the malicious content of the file. It scans files using Content Disarm and Reconstruct and if any malicious content is found, then it removes that part of the content and reconstructs the file. It also uses machine learning technologies to optimize the file scanning process and has an adaptive sandbox which detects advanced persistent threats from the files.

It features proactive data loss prevention which scans all formats while sending files outside to help maintain compliance with PCI, GDPR, file-based vulnerabilities, and software bill of materials, identifying vulnerabilities in files and software components to secure supply chains. The best thing about it is we use this on cloud-native security, thus it supports cloud applications.

The effectiveness of MetaDefender in blocking or sanitizing content based on policy is evident in multiple points, such as having a multi-scanning engine detecting threats where we use multiple antivirus engines simultaneously to scan files with accuracy and block threats. It helps enforce policies such as blocking executable files, disallowing macros in office files, or restricting certain file types, enforced consistently across the endpoint, email, and file transfers. Regarding sanitizing content, these features remove active contents such as scripts, macros, and embedded objects while preserving the legibility of the file and neutralizing zero-day exploits in hidden documents or images, making it useful.

Content Disarm and Reconstruct features remove active contents such as scripts, macros, and embedded objects while preserving the eligibility of the file, ensuring the file remains usable even if malicious contents are blocked.

In my organization, while using this tool, we found that there were a few files flagged as suspicious; however, those were not suspicious and it was a false positive, so that can be improved.

False positive results were an issue, and it took time to scan files if the file size was greater than 1 GB.

For larger files greater than 1 GB, it needs to be improved.

In some cases, the reconstruction of the file led to a failure of code deployment and it flagged a valid file as malicious, which was not effective; however, in other types of files, it was very effective and could scan files properly.

We have already covered all the main suggestions; however, it can be improved to reduce false positive results, and scanning could be faster to process more files in a day.

I have used MetaDefender and Globalscape EFT for three years now.

After implementing it, the number of incidents involving malicious files has reduced, making it a useful tool for keeping our systems compliant and saving servers from outsider threats.

In my organization, we use around one million files daily, and while certain locations cause file sizes to grow rapidly, MetaDefender handles the increased file volume effectively.

Customer support was good; we faced issues a few times and they were able to assist us within an hour, troubleshooting the issues multiple times.

We saved a lot of time for scanning files. Earlier, multiple teams from each department scanned files. However, with the implementation of MetaDefender, we could scan all incoming and outgoing files at a single point, and if any files needed further attention, they could easily be found in reports which we shared through SIEM with multiple teams.

MetaDefender is generally considered a premium price compared to a standard antivirus solution, and since it has multiple engine scanning, deep Content Disarm and Reconstruct, and sandboxing capabilities, we utilize enterprise-grade features. The price varies based on deployment types; we only used it for file transfer and cloud integration rather than email, which kept it within our budget. The initial setup cost was a bit higher, but once it started delivering results, it proved useful for us.

I did not evaluate other options; it was directly notified by higher management that we were going to use MetaDefender. They had evaluated it at their level, and I only know of some tools that were considered, namely Symantec Endpoint Protection and Trend Micro Deep Discovery.

If anyone is using file transfers or wants to monitor their files and emails to scan attached files, MetaDefender is a useful tool where you can integrate your file transfer tool with MetaDefender, which is a plug-and-play solution supporting both cloud and on-prem involvement, making it very useful.

I deducted those two points because there were a number of times where I was getting false positive results and it took time to scan files if the file size was greater than 1 GB.

In multi-scanning engine, the best part is that it scans all the components of the file, removes the malicious content, and reconstructs the file, which is excellent.

For sandbox analysis, there was another team working with it, so I was not using it actively.

I was using audit visibility features, which helped me keep our systems error-free and bug-free. Whenever we found any file with malicious content, we reported it to the security team, they analyzed it further, and we informed relevant stakeholders who took further actions. I gave this review a rating of 8 out of 10.

MetaDefender serves as a file security gateway that scans, cleans, and sanitizes files before they are allowed on the network, which stops malware, ransomware, zero-day attacks, and any kind of malicious files from entering the network.

For one of our partners, we were dealing with a large financial services business handling mortgage applications. When files were scanned into the network, every single file that was sent was then scanned by the multi-scanner, and if any contained even a slight amount of malware, we performed deep CDR file sanitization that removed everything that could be malicious and rebuilt the file.

The main use cases that we tend to see are all the antivirus engines as part of the multi-scan, and the second use case that is emerging frequently is file sanitization, also known as deep CDR.

In my experience, the best features MetaDefender offers include the number of different antivirus engines that can scan files through multi-file scanning, often using 20 to 30 engines, with the top premium package around 33 engines, capturing 80 to 90% of malware in all those files. If any engine detects malware, the file is blocked, which increases detection because different engines catch different malware.

When dealing with central government and defense, we find that if there is any kind of malware on the network or the file, whether that is a software file, hard disk file, or a pen drive, it cannot be allowed on the network. This is when we put it into the sandbox and perform file sanitization to ensure that nothing malicious comes into the network.

Whenever we are dealing with central government or defense contracts, MetaDefender's core philosophy of trusting no file means it scans files, rebuilds them, and verifies their reputation, ensuring they contain no malicious content. This positively impacts our organization by detecting malware and stopping any kind of data leaks through the network.

In terms of measurable outcomes across central government and defense, we are seeing saved time when files go through the antivirus file scanners. In financial services, such as with mortgage applications, the process sends files straight into MetaDefender file scanning that cleans out any malicious content.

I don't think there are many feature improvements needed; it's a great solution. The main thing is just the pricing because it's such a top-end enterprise product. For smaller partners with a customer base that isn't as affluent, the price can be a barrier, making it more of a 'nice-to-have' for their budgets compared to cheaper competitors.

I've been using MetaDefender for just under 18 months.

MetaDefender is 100% stable, making it one of the best cybersecurity solutions we offer, which provides confidence in promoting and recommending it to others.

MetaDefender's scalability is considerable. We handle vast amounts of traffic from banking, defense, and critical national infrastructure, ensuring that even one malicious file does not enter our networks.

Customer support from Opswat is commendable. Their customer service team, distribution team, and regional sales managers provide excellent aftercare and set us up for upselling across the entire MetaDefender portfolio.

From a partner's perspective, the channel team and customer service have delivered strong support. I would rate it a nine because I have not interacted with customer support directly, though the support provided has been strong.

We have not used a different solution. We focus on best-in-breed vendors, with Opswat being our chosen solution due to its effectiveness in the market.

I believe we see a return on investment through time savings and reduced need for unnecessary personnel. Having both cloud and on-premise solutions enables effective file sanitization and vulnerability detection while preventing attacks that save costs and protect reputation.

Regarding pricing, setup cost, and licensing, I find the pricing for kiosks, cloud, deep CDR, and adaptive sandbox appropriate. We are seeking more service partners for Opswat's professional services to ensure smooth implementation.

Before choosing MetaDefender, we considered alternatives such as Reversing Labs but found their offerings to be inferior, especially for our defense and central government contracts, where Opswat stands out as far superior.

To achieve a perfect score of 10, MetaDefender would need to cater to every partner's ability to sell. While the price is a consideration, the benefits of scanning, removing, detecting, and sandboxing outweigh it significantly.

I advise those considering MetaDefender to reach out to reseller partners for guidance on file sanitization and to explore setting up a proof of concept to see the value MetaDefender brings, with demos available directly on their website.

My overall rating for this solution is 9.

I deploy it in different environments and manage a team of professional services that deploy MetaDefender products in customer environments. I talk with customers and am aware of use cases where new or additional needs arose after MetaDefender deployment. For example, customers needed to transfer files between source and destination using MetaDefender. I know that MetaDefender File Transfer Protocol, or MFT, is now supported, but in the past, it was not. There are products that have been developed from customer needs, such as products that can transfer files from source to destination with integration to MetaDefender.

The detection rate of the MetaScan multi-scanning feature is very high. When discussing Linux with five engines or ten engines, it can detect most of the viruses that are tested. I have seen very few instances where customers reported a virus that was not blocked after a PT scan. When we verify these cases, we confirm they occurred. Of course, every engine has its own detection rate, and you cannot achieve 100 percent detection. When using MetaDefender especially on Windows, the detection rate is very high, and it increases as you use more engines. Most customers I see using eight or twelve engines on Windows have good results with both configurations. When customers use a large number of engines, such as twenty engines with integration to external scanners, the results look almost perfect because in cyber security, there is no 100 percent, but it is close to that.

The effectiveness of Deep CDR in reconstructing files safely and without signatures is very effective. When people configure Deep CDR correctly, it performs as it should. Sometimes some files are negatively affected by CDR. If I must be specific about what could be helpful, it would be to create a policy or workflow in OPSWAT terminology that handles cases when CDR cannot be performed or harms the file. I am not certain if the system can check whether CDR has harmed a file, but I know of use cases where CDR was disabled because it made files unable to open or unable to open properly. I believe this is very effective and is the most effective engine of OPSWAT because customers ask for OPSWAT for two main reasons: the CDR capabilities and the multi-scanning engines.

Some feedback indicated that it takes too much time to configure certain policies because there are many options. Some people appreciate this because you can configure anything, but I believe MetaDefender should have a wizard or general policies that can be used for 80 percent of customers.

I use the expanded file type and archive coverage feature sometimes, especially for customers who try to scan large archives with the deep scan capabilities of OPSWAT and Deep CDR. This provides full protection because it scans every single file, but sometimes it takes too long. When discussing CAB files or archives for patching or server updates and BIOS updates and operating system updates, the scanning process takes too long, and it was difficult for customers who sometimes decided not to scan because the scanning time was excessive.

I use the reporting and audit visibility features. Some capabilities are lacking in reporting because we do not have full statistics that are easy for users to understand. If something requires checking and then referring to documentation to understand it, that is too much for most users. When looking at one of the statistics, you can see how many files have been scanned and then you see a number out of 500 or a different number if you change it. It is not a number of files or scan processes; it is a number of files inside a file. When you scan a PowerPoint presentation file, for example, it counts as forty different files because of all the sub-files. I understand from customers that when they look at the visualization data or statistics, they do not understand what is happening there.

Most customers I see do not use the file-based vulnerability assessment feature. It has some good results about vulnerabilities, but I am not certain if it is that helpful because many organizations, when they deploy a file and see that there are vulnerabilities, still deploy it because it is part of the code. It can produce results, but those results do not cause any action. Many products have something more advanced than vulnerabilities and static scoring. They have tools that can inform you about a vulnerability, whether the vulnerability is exploitable, if it is weaponized, and if someone can use this vulnerability in your environment. The file-based vulnerability feature works, but for most people, they do not take any action based on the results or block files because of file-based vulnerabilities.

I have used MetaDefender for one and a half years.

The stability of the system is very high. I have not experienced crashes or downloads when the server is rebooted, and the server runs well after rebooting. I have not seen errors frequently. I recall one problem with MetaDefender email where there was an unusual issue with some connections remaining open, but I found this kind of problem only once. Most of the time, it is very stable, and you can rely on MetaDefender Core and also email. The stability problems with OPSWAT occurred when they attempted to migrate one product, such as the email product, to a SaaS service; it was not stable in that environment.

MetaDefender is very scalable. From what I understand, when you use one database for all instances, you can deploy ten different servers or ten different instances with a separate database for each one. You cannot check the status of scans in each one; you have to check each specific instance. When discussing a shared database, it is scalable, but the performance is harmed. I do not know the specific impact, but it is just a feeling I have.

I have contacted the technical support of OPSWAT. The quality of answers from support has been very good most of the time. It can be useful when contacting support to mention what needs to be collected and what needs to be sent before opening the ticket. For example, if discussing an issue, support will probably ask for specific logs. This can save time because many vendors, when they check something and ask for logs, need those logs from the beginning. If you open a ticket and the answer is to proceed, and the answer after one day is that specific logs are needed, it is better to know that from the beginning.

Positive

The deployment of MetaDefender on Windows and Linux machines is very easy and quick. When discussing deployment of containers or deployment in Kubernetes environments, it sometimes takes too long. The deployment of the sandbox product takes too long. The deployment of MetaDefender email security, core, and MetaDefender kiosk has very easy and quick deployment.

One person can deploy MetaDefender. It is one of the products that can be managed by one person and managed easily, including the deployment.

The pricing of MetaDefender is about hundreds of dollars. If I remember correctly, when someone attempted to buy from us one instance of OPSWAT, it was about nine thousand dollars for multi-scanning with eight engines and also the CDR module. The pricing is good, but when you add additional engines, this is what causes most people not to use additional features. Every additional engine, not about scanning engines but other engines such as file-based vulnerabilities and so forth, requires another license. If customers could buy in one price the basic package, which includes CDR and multi-scanning, in one price, many people would prefer to do it. However, when it is necessary to pay for every single engine or single feature, I believe most customers do not want to use it for that reason.

I have used alternatives to MetaDefender, but not as an administrator, only as a user. I used some kiosk products similar to MetaDefender kiosk. There is an alternative called Sasa Software, I believe it is Sasa Scanner or Gateway Scanner. I used it, but the user interface is not as good as OPSWAT. The experience with this product is not as good as the experience with OPSWAT, and the time it took to scan some large files was very long. OPSWAT is the best alternative. I also see on customers' side another product called RESEC, and this product also was not a good experience. The user experience is not good enough in this field, and when users try to configure policies, it lacks features when compared to OPSWAT.

The sandbox helps in cases of suspicious files. However, the sandbox alert indicates suspicious activity for many different files. When we test some files that we download from vendors' official sites for server BIOS upgrades or firmware upgrades on servers, such as files from Dell or HPE, these files are also considered suspicious for many use cases. The sandbox is good only for specific areas. If discussing email, it can be good. However, if discussing large files, the sandbox can indicate suspicious activity in almost every executable file. This causes customers not to believe in the results. They say it is suspicious, but it is fine to them. Even if something is actually suspicious, it does not receive attention because of the many files that should be legitimate but are considered suspicious.

Perhaps the effectiveness of the sandbox and level of suspicious files can have two different levels. If asked how it can be better, a different score or different tag for suspicious files from known vendors and suspicious files from unknown vendors could help. Multiple levels of suspicious files, scores, or tags could be something that can be configured. For example, when using the sandbox to scan files that you download from the internet to different environments, such as air gap environments, and in this environment you manage IBM servers, if you scan the file and select that you are using it for IBM servers before scanning, it could be considered less suspicious. The system could also load a certificate of the file that you download and then determine whether it has a trusted certificate or a certificate that is probably good enough or probably not suspicious most of the time.

I am not certain if MetaDefender can do anything else. Perhaps if they want to improve vulnerability management, instead of managing static CVEs, they could have a different method involving CVEs but something else as well. For example, CVEs that can be harmful because they are exploitable could be differentiated. However, this is something that cannot be managed at the MetaDefender level because it is just about files on a perimeter and does not understand the deployment of the environment because it is not running in the real environment. I am not certain if there is a way to do this better.

There are some upgrades when MetaDefender has new features, so you have to upgrade. This is not about the upgrade of the engines that happen all the time if you have an internet connection or do it manually. The maintenance can take significant effort that causes most people not to upgrade and update it all the time. Considering offline users, offline environments, and environments with no internet, easier updates could be helpful. The upgrade of MetaDefender version, whether email or MetaDefender Core, is very quick. I would rate this review eight out of ten.

My main use case for MetaDefender involves the Central Management Console, core service, and ICAP service.

In my day-to-day work, I use MetaDefender to scan endpoint security, but we did not have a product to cover API traffic scans. MetaDefender OPSWAT provides that solution, and also the ICAP scans. It is a really good product. We have customers sending all the files via API calls, and they will be scanned by OPSWAT for antivirus scan and also Data Loss Prevention scan. It is a great product.

We have more than ten different vendors connected to MetaDefender for scanning, and it is working very well.

The best features MetaDefender offers are the ICAP Scan and API Scan. For the ICAP Scan and API Scan, they stand out to me because they are easy to manage and can also adopt multi-clients at the same time and scan by seven different scan engines and different antivirus signatures scan.

MetaDefender positively impacts my organization by filling the gap, as we do not have any other product that can scan API calls. It has helped to improve compliance requests. It also scans all the API traffic and makes sure the API traffic is secured and clean.

MetaDefender can be improved by upgrading the Linux version, which is using many free tools such as MongoDB, Postgres, and OpenSSL. It can be easily targeted by hackers. If MetaDefender can upgrade those free versions of products regularly to cover those vulnerabilities, that would be beneficial. Regular patching, upgrades, and CVE coverage would be beneficial, especially because AI attacks can exploit any vulnerabilities, CVEs, and zero-days from those free MongoDB tools, which are an easy target.

Regarding MetaDefender's AI capabilities, I do not see much AI integration with MetaDefender at this moment. My thoughts on its accuracy and reliability of output are that it relies on signature-based antivirus scan, which is not sufficient for AI-kind vulnerabilities or hacking. This part needs improvement.

I have been using MetaDefender for five years.

MetaDefender is a stable product.

MetaDefender's scalability is great. We can increase the central management server by adding more CPU, RAM, and disks, and we can add more clients to the scan and create a policy for them. It has great scan capability and great extendibility.

Customer support is great. I have worked with the Vietnam team quite a few times, and they are always very active, proactive, and offer remote sessions quite a few times. It is a great service.

Previously, we were using McAfee antivirus scan servers for ICAP filters, but with increasing API call requests, MetaDefender filled that gap and provided the API call scan service, which is great.

We tried Deep CDR for a while, but it was consuming a lot of CPU and RAM, so we stopped that.

With the recent enhancements to policy orchestration and engine parallelization, we upload all MetaDefender detection events into Splunk, and our incident response team is using the Splunk SOAR product to automate all those detections and reactions. It is a Splunk integration. I assess the effectiveness of the solution in blocking or sanitizing content based on policy by noting that we are using Splunk, and the CISO and the incident response team are using the Splunk SOAR console to perform automation detections and reactions.

I see a return on investment.

My experience with pricing, setup cost, and licensing is that the cost and license fee is increasing every year.

Before choosing MetaDefender, we did not evaluate other options. We mainly wanted to use OPSWAT for API call scans, and we could not find any other product in the market at that time.

My advice to others looking into using MetaDefender is that it is a great product. We are only using the on-premise product because of company policy, as we are not allowed to upload our customer data into the public cloud. I think the hybrid cloud and private cloud product would be beneficial. That is the trend, so using hybrid cloud mode is a beneficial option for all other companies. We are currently still using the on-premise product.

We are not using the enhanced reporting and audit visibility features at this time.

The file-based vulnerability assessment feature is great because it can scan using seven different antivirus scan engines, but with AI attacks now, signature-based detection is not sufficient, which is a problem for all antivirus product vendors.

I give MetaDefender an overall rating of ten out of ten.

I have been working with MetaDefender for the past year. I am a customer of MetaDefender. I use MetaDefender for CDR in an Azure Blob environment. The features of MetaDefender that I have found the most valuable include the option to connect to the storage account and create a connection between different blobs and containers, as well as creating a CDR policy and workflow that works for us.

I am using the Expanded File Type and Archive Coverage feature. I am using the Enhanced Reporting and Audit Visibility features. The Enhanced Reporting and Audit Visibility features help us to understand what exact type of files are uploaded to the blob and which type of files are blocked or get scanned. We can understand exactly where we might miss the business logical flow and correct it.

The impact of MetaDefender on my organization's scanning process is great because I have the option to harden the platform. If the developers make mistakes in the application development cycle and miss hardening the types of files or the archive levels on the application layer, with MetaDefender, I can restrict it on my end and be sure that no other files are accepted except those that I permit. It will not even be considered to be scanned.

MetaDefender could be improved in the future regarding the notification issue. OPSWAT delivers an API structure that you can query via APIs for a lot of data from OPSWAT. However, many customers, including us, are looking for more responsive notifications. If OPSWAT sees that the file uploaded has failed because it doesn't fit the policy or the file types, we would like to get a notification about it rather than developing something on our own that would query OPSWAT for the data.

The stability and reliability of MetaDefender are good. I have not yet tested it for disaster recovery. I am planning to do so to understand how it really works in different recovery solutions, such as a cluster or an active-active solution. Therefore, I cannot tell you about this because I have not tested it yet.

When considering the scalability of MetaDefender, I cannot really size it because when you are planning a CDR solution in your company, you should understand where you could have a bottleneck of the files or the hardware. Is it possible to upload a lot of files and still have OPSWAT scan them all, or would they be queued and how much time would it take? You need to plan it. You need to do some sizing before installation and understand exactly what you are seeking from the solution and how it fits your organization.

I do not often communicate with the technical support of MetaDefender, only with the integration team. I am happy with my interaction and communication with MetaDefender's team. The communication was great and understanding. It was easy because I was familiar with OPSWAT Core, not so much with MetaDefender, but with OPSWAT Core I was familiar, and the policy and everything else that you configure on OPSWAT Core. The communication was great.

Before MetaDefender, we were using Sasa, which is a platform for CDR, but we use Sasa not exactly for the same business logic. We use Sasa on a different path inside the company, and OPSWAT is really convenient for use via APIs and connecting with storage accounts and other resources that we can upload files from.

I participated in the initial setup and deployment of MetaDefender. The initial setup process was pretty easy. There were a few problems with the SSO configuration, but everything else was pretty straightforward. To integrate the platform and install it very fast and in a good manner, you should plan it very well and understand exactly what your environment is in the company. Whether you are going to install it on-premise or in the cloud environment as a VM or any other solution that they are suggesting. I did not see any problems except the SSO configuration. Everything else was pretty fast and convenient.

I am not much aware of the pricing and licensing of MetaDefender. I know that the SaaS platform is very expensive, and we did it on the IaaS platform in Azure. So I am not very familiar, but because it is IaaS, most of the money goes for the VM and the infrastructure in Azure, and of course the license for the CDR engines. I am not very familiar with the prices.

Before choosing MetaDefender, I evaluated other options and other vendors for these use cases, and there are not many vendors doing a great CDR. I know only two that really do the job. We chose MetaDefender because it gives us the option to do more with the CDR, and of course, because of the APIs and the storage accounts because this is the environment that we looked for. We looked for a solution for a specific cloud environment, so MetaDefender was a better solution.

From the beginning, I worked with OPSWAT MetaDefender for other customers at my other job a few years ago. From the last year that we integrated OPSWAT in our company, I have not seen any improvements. It is still okay. It still does the job and makes a good assurance that the files that are coming are really whitelisted and content disarmed. It has not become worse, but it has not become better either. The percentage of accuracy is great. I do not miss anything, but I have not felt any improvement. The effectiveness of MetaDefender in blocking or sanitizing content based on policy is effective. I did not see any problems with the sanitation or something that should be blocked in the test. I did not have such issues.

Before deployment, when looking for a safe path to upload files, you will definitely look for CDR solutions because it depends on the workflow that you are trying to achieve. If there are customers at the end that will upload the files, or some internal business logic that your partners inside the company will upload the files, it depends on what you are trying to achieve. If the files are coming from outside the company, of course, CDR will be the best solution because you would want to restrict the type of files, even the size of the files, and be very restrictive on that end because those files are from the outside, and this path is published outside and is external. When you are looking from the inside, when you are working with partners inside the company, such as different departments, you will not always use the CDR solution. The integration of multi-scanning and Content Disarm and Reconstruction affects my data security operations effectively. If you are trying to disable any active links or anything that could be malicious, OPSWAT did that. It blocks the file types that we are not willing to have inside the company or are not approved. Therefore, it helped us. My impression of the detection rates provided by MetaScan Multi-scanning is great. I have not seen a lot of malicious content on those files that we are scanning, but in the test, I had a pretty high assurance that MetaDefender would find the content that is not welcome at our application end. It is quite easy to research and understand what exactly happened.

I describe the effectiveness of Deep CDR in reconstructing files safely and without signatures as very effective. That is why we chose a CDR platform for those specific workflows that our business wants to accomplish, and not any sandbox or EDR solution that will block the files because they are malicious or suspicious. The CDR still gives us the option to retrieve the file but without any malicious content inside. I do not think I am using Adaptive Sandbox analysis. My overall rating for this solution is eight out of ten.

I am an integrator for MetaDefender. My usual use cases for MetaDefender involve connecting the products into the environment of the customer, including MetaDefender Core, ICAPs, endpoints, and all the related components.

I find the CDR, specifically the CDR ability, the most valuable aspect of MetaDefender so far. I appreciate the CDR because I can show customers how it works and demonstrate the effectiveness of this feature, and it is very helpful.

I did not pay much attention to the expanded file type and archive coverage feature initially. Could you explain what you mean by file type?

The enhanced reporting and audit visibility features are acceptable. Some customers of mine had problems with the health checks and monitoring of the logs, but it has improved, so that is very positive.

Most of the time, in our experience at Danet Communications, we work with government offices, and they need the CDR. However, because CDR is affecting files such as MSI and EXE files, they are always creating new passes of scanning. This is acceptable, but I would like OPSWAT to improve that, perhaps to decrease the impact when the process becomes slower. I am not sure if that is something that is possible.

There is something about MetaDefender that I think could be improved or enhanced, specifically regarding a feature request. Something that annoyed me was the less noticeable improvement from version 5.8.0 to 5.9.0 of MetaDefender Core. Now you have to search in the block if you want to create a blocklist, which is somewhat annoying when searching for your file. I may have just been accustomed to the old version.

From my experience, there are perhaps some improvements in workflow automation with the recent enhancements to policy orchestration and engine parallelization. However, there are many settings in the workflow that you cannot quickly understand what they are doing. Adding a question mark around them that provides a bit more information about that option would be beneficial.

I have been working with MetaDefender for approximately six to seven months.

Regarding the reliability and stability level of MetaDefender, there are minor problems here and there, but nothing specific. Every time when help is needed, we receive the assistance.

When I say there are some troubles here and there, I mean there are different and unusual bugs or complications and things that cannot be connected to each other even though all the network configuration is acceptable.

The scalability level of MetaDefender is good. It is learning and increasing with every patch, and that is acceptable.

When I need help, I reach out first by trying to find information in the documentation. If I cannot find that, I go to the Ozi AI. If I see that the AI cannot help me, then I ask for an agent.

When it comes to my communication with agents, I find they are responsive and professional. A lot of the time, they are busy, so they cannot participate in calls or Teams meetings. However, if we schedule a meeting, they will attend, especially if it is very important.

I usually participate in the initial setup, including the installation of MetaDefender. Most of the time, I send requirements for the server, and the customer has to create a server that meets what I have requested. After the customer has made the prerequisites, I can work with them on installing and connecting the products into their environment.

The initial setup usually looks like this for me: first, I need to send the prerequisites for every product, and I reference OPSWAT documentation to see what is needed, such as Visual Studio or Desknet. Then I send downloads of the products.

I usually find the initial setup has small challenges such as connectivity issues, but these are not on OPSWAT's side. They are more related to the customer's environment.

I assess the effectiveness of MetaDefender in blocking or sanitizing content based on policy as very good. It contains a lot of file types, and most of the file types are included, so that is acceptable.

My impression of the detection rate provided by MetaScan multi-scanning is positive. I work mostly with the core, and my clients have not encountered false positives or those kinds of issues.

I evaluate the effectiveness of Deep CDR in reconstructing files safely and without signatures as good. I measure if it is effective by processing a lot of files, verifying that the content I want to be removed is being removed, and confirming that the hash is different.

To be honest, the file-based vulnerability assessment feature is more of a toggle option that we always enable, but we have not thoroughly tested it. I do see the effectiveness of this feature.

I think the adaptive sandbox analysis of MetaDefender works well. We do not have many customers using it, but from the customers who are using it, it functions effectively. Some of my customers describe its impact on analyzing suspicious files as adding additional layers of security. The reviews were positive, and while it may slow the scanning time slightly, that is understandable.

I rate this review an eight out of ten overall.

My main use case for MetaDefender is to scan files, URLs, and software for malware and security threats before using or deploying them. Almost two months ago, before deploying a Docker image to AWS ECS, I used MetaDefender to scan the software package for malware and suspicious files to ensure it was safe to deploy.

I also use MetaDefender to scan downloaded dependencies, deployment packages, and third-party software for malware or suspicious files before integrating them into our AWS infrastructure. We primarily use MetaDefender as a part of our security software and pre-deployment validation process, helping us scan files, application packages, and third-party dependencies before they are introduced into our AWS environments. Our deployment workflow is managed through Jenkins CI/CD, where security checks help reduce the risk of deploying malicious or compromised files.

MetaDefender has positively impacted our organization by improving our deployment security and adding an extra layer of protection before software reaches production. Multi-engine scanning helps us identify potentially malicious files early, reduce security risks, and deploy with greater confidence. It also saves time by making security checks easier and more consistent.

We use multi-engine scanning to check deployment packages and third-party files before integrating them into our AWS ECS environments, helping us catch suspicious files early and avoid introducing unverified software into production. While I don't have exact figures, MetaDefender has strengthened our pre-deployment security checks and improved our confidence in releases.

The integration of multi-scanning with content disarm and reconstruction (CDR) strengthens our overall data security. Multi-scanning helps detect known and suspicious threats using multiple security engines, while CDR removes potentially harmful content from files while keeping them usable. Together, they reduce the risk of malicious files entering our AWS environments and make our pre-deployment security process reliable.

The recent enhancements to policy orchestration and engine parallelization have made the scanning workflow more efficient. Policy orchestration helps apply security rules consistently, while engine parallelization reduces waiting time by running multiple scanning engines simultaneously, which leads to faster results, less manual intervention, and smoother security checks before deployment.

The best features MetaDefender offers include scanning for malware and a multi-engine malware scanning capability that checks files using multiple antivirus engines, making it easier to identify suspicious files, malicious code, and potential threats before deploying applications to production.

One feature I rely on the most is multi-engine scanning because it helps me verify files, application packages, and third-party dependencies using multiple security engines before deployment. I find it especially useful for reducing the risk of introducing malware into our AWS production environments.

The AI capabilities are useful for identifying suspicious files and potential security threats. Its multi-engine approach provides additional confidence by comparing results from different security engines. However, I would not rely on it blindly and will still validate critical findings through additional security checks before approving production deployments.

We use expanded file type and archive coverage scanning where applicable, which is helpful because application deployment packages often contain multiple files, dependencies, and nested archives. Scanning these contents provides better visibility into potential threats and reduces the chance of malicious files going unnoticed, adding an extra layer of confidence to our pre-deployment security process.

We use enhanced reporting and audit visibility to review scan results, track detected threats, and maintain better visibility into our security checks. It helps us understand why a file was flagged, investigate suspicious activity, and maintain a record for further security reviews.

My impression of MetaDefender's multi-scanning detection rates is positive. Since it uses multiple antivirus engines, it provides broader threat coverage than relying on a single engine, and I find the combined results useful for identifying suspicious files and reducing the chances of missing potential threats. I also consider false positives and validate critical findings before taking action.

I assess Deep CDR positively because it helps reconstruct files by removing potentially malicious content while preserving their usability, which is particularly useful when handling external documents and files from untrusted sources. It adds another layer of protection by reducing dependence on traditional signature-based detection, though reconstructed files should still undergo security validation before use.

MetaDefender is useful for enforcing security policies by identifying malicious files and helping block or sanitize potentially unsafe content before it enters our environment. I particularly value the ability to apply security rules consistently, which helps reduce manual security checks and ensures that files meet our security requirements before being used in production.

The file-based vulnerability assessment feature is very useful because it helps identify security risks in files and software packages before deployment, allowing us to catch vulnerable components, outdated dependencies, and potential security issues early in the CI/CD pipeline rather than discovering them in production. For DevOps teams, this supports proactive security and safer releases.

We use adaptive sandbox analysis when deeper analysis of suspicious files is needed. It is useful because it examines file behavior in an isolated environment, allowing us to identify potentially malicious activity that traditional scanning might miss instead of relying only on static signatures.

MetaDefender already provides many useful capabilities. However, I think it could be improved with better integration into CI/CD pipelines such as Jenkins and GitHub Actions, automated scanning, faster scan results, clearer vulnerability reports, and real-time alerts would make it easier for DevOps teams to identify threats and block unsafe files before production deployment.

Better automation, detailed reporting, and smoother DevOps integration would make MetaDefender even more useful for teams managing cloud infrastructure and frequent deployments.

Regarding MetaDefender's AI capabilities, I think they are valuable, especially when it comes to identifying suspicious files and potential security threats. Governance and data protection are equally important, and I would like to see strong data privacy controls, transparent AI decision making, clear audit logs, and strict access management to ensure sensitive files and information remain protected.

I have been using MetaDefender for approximately one to one and a half years.

MetaDefender has shown reliability in my experience with no downtime or reliability issues. I find MetaDefender to be stable with no downtime or reliability concerns.

MetaDefender offers better scalability as it is a SaaS solution.

I do not have any experience with the support team, but I think that having customer support would be beneficial.

We were using a different type of solution for file checking, such as Trivy and traditional antivirus tools, as well as manual security checks. We started using MetaDefender because its multi-engine scanning provides broader threat detection, better visibility, and an additional layer of security, fitting better with our needs to validate files and software before deployment.

Regarding return on investment, we have seen value mainly in time saving and improved security efficiency. Automated scanning reduces the need for repetitive manual file checks and helps identify suspicious files earlier in the deployment process, also reducing the effort required for initial security investigations. While I don't have verified financial figures, the biggest benefit has been faster security validation, fewer manual checks, and greater confidence in production deployments.

In terms of pricing, I find nothing significant. Overall, my experience with MetaDefender's setup and licensing has been positive. The initial setup required some configurations and understanding of the security policies, but the process is manageable. Pricing is reasonable considering the security capabilities it offers, though I would appreciate more flexible licensing options and transparent pricing as usage and scanning requirements grow.

Before using MetaDefender, we evaluated options such as traditional antivirus solutions while looking for a solution that offers multi-engine scanning, file sanitization, and better integration with our security workflow.

I rate MetaDefender nine out of ten because it provides reliable multi-engine scanning, helps detect potential threats early, and adds an extra layer of security to our deployment process. It is easy to use and gives me more confidence when handling files and software. I am keeping one point aside for improvements in CI/CD automation, integration, and reporting.

MetaDefender is one of the best tools I recommend for production environments if you want to scan any vulnerabilities in files or URLs. Before using it, ensure you have a proof of concept of this tool and ensure you have trained personnel before integrating it into your production or test environments, so you can test how it will impact your organization. Overall, I recommend using MetaDefender.

MetaDefender prevents organizations from file-borne malware and file-borne threats by preventing threats at the entry point itself.

MetaDefender's threat detection ratio is quite high because it uses multiple anti-malware engines. Sanitization helps eliminate typical zero-day threats such as macro-based attacks and script-based attacks.

Deep CDR feature in reconstructing files has provided significant value to customers. When they receive phishing links, dummy QR codes, or embedded actions defined on documents, Deep CDR removes all those potential threats.

MetaDefender supports all expanded file type and archive coverage features, which means most of the 4,000-plus file types are covered. It provides a quite deep scanning process. Archive extraction gives more visibility of the files.

The file-based vulnerability assessment feature is straightforward. When downloading a file from the internet and scanning it, information about known vulnerabilities is provided. It gives advanced information about the vulnerability.

With MetaScan multi-scanning feature, certain web shell attacks can be detected which others cannot. Whether it's 8 anti-malware engines or 20, the detection ratio and rate are quite good.

Reporting still requires improvement, but otherwise the solution is excellent. Other areas include centralized management, providing the capability to manage all instances from a single console, centralized reporting, and integration through central management.

I started working with MetaDefender in 2021.

Uptime is 99.99%, so it is 99% stable and reliable.

Scalability with MetaDefender is very good.

Support is excellent. Technical support from OPSWAT is excellent.

We are not working with Trend Micro, also called today Trend AI Vision One, which is hardcore competition. We are purely working on MetaDefender.

Installation for the deployment of MetaDefender is straightforward.

Many threats are prevented before entering the organization with MetaDefender. It definitely saves more effort for the SOC team if threats are being eliminated at the entry point itself, allowing them to focus more on other things.

MetaDefender is affordable. It is flexible, and pricing-wise there are no concerns with this solution.

When comparing MetaDefender to other solutions, I compare it to Trend Micro, Broadcom, and Check Point for email.

MetaDefender is leading with respect to competitors as an all-in-one platform because no other tool has all the platform built-in.

For example, MetaDefender cannot identify the source itself, but if a file is scanned, the complete detail of the scanning can be seen.

If someone modifies a policy, adaptive sandbox analysis takes a little bit of time, but it gives accuracy up to 99%.

Continuous improvement that OPSWAT is doing with enhancements made to policy orchestration and to engine parallelization demonstrates that OPSWAT is adapting.

I rate this solution a 10.

My main use case for MetaDefender is for multi-scanning purposes, including Deep CDR, sandbox-based analysis, and protecting the organization from malware and other file-based threats delivered through email, particularly suspicious or unknown attachments. I primarily view it as an additional inspection layer for email attachments, using its multi-scanning capability to analyze files with multiple detection engines. The Deep Content Disarm and Destruction capability is also valuable because it can remove potentially malicious content from supported files and provide a safer version for the user. From a SOC's perspective, this is particularly useful for handling files that may bypass traditional signature-based security controls while email filtering is happening. It gives us additional confidence when dealing with documents such as PDFs and Office files and all other materials that we receive through email. MetaDefender prevents malicious or weaponized files from reaching users while reducing the risk associated with unknown, zero-day file-based threats.

The best features of MetaDefender include multi-scanning, multi-layered scanning of any email or attachment, the CDR feature, and the sandboxing analysis capability. The multi-scanning feature is particularly useful because a file can be checked against multiple antivirus engines instead of relying on a single detection engine. Deep CDR is one of the strongest features because instead of only detecting whether the file is malicious, it can sanitize supported files by removing potentially dangerous content and reconstructing a safe version. This is especially useful for documents and email attachments where we still need to allow the business to work with the file. The adaptive sandbox is another valuable feature for files that require deeper behavior analysis, providing another layer for identifying suspicious or malware-like content that may not be obvious through the traditional scanners that we use.

MetaDefender has a positive impact by adding multiple layers of file scanning, email classification, and attachment investigation in a more efficient way. Instead of just relying on the verdict from our primary email or endpoint security solution, we can use MetaDefender to get additional analysis across multiple engines. This is especially helpful when dealing with suspicious or previously unseen files, zero-day attack files. Deep CDR has also been useful from a risk reduction perspective because potentially dangerous content can be removed from supported files while still allowing users to work with a usable version of the document. Overall, MetaDefender has a positive impact on analysis and detecting suspicious files, leading to greater confidence in our environment. It has also helped reduce some of the manual efforts involved in determining whether the attachment is safe or not.

MetaDefender is quite better in all aspects it has been designed for. We could enhance the user interface and user experience, as the platform has many security capabilities, but some configuration and policy management tasks can take time to understand, especially for someone using the product for the first time. I would appreciate more intuitive reporting and dashboards. The security information is useful, but making key metrics, detection trends, false positives, and remediation actions easier to understand would help a SOC team quickly identify areas requiring attention. Another area for improvement would be reducing false positives and improving processing time for large or complex files, which sometimes may require additional manual review. The CDR is a very useful tool, but clearer handling and exception management should be implemented when sanitizing legitimate files. Automation and integrations could also be enhanced, particularly around recommending appropriate actions based on scan results and simplifying integration with other security tools.

We have been using MetaDefender for more than two years.

From my overall experience, MetaDefender is a very stable and reliable product when it comes to the outcomes of file analysis and email attachments received. In my day-to-day experience, I have not encountered any major stability issues that would significantly affect email or file security operations. The core functions, such as multi-scanning, sandboxing, and file inspection, have been consistent. Once the policies and integrations are configured properly, there is minimal ongoing maintenance required to keep the solution operational. I would monitor its performance when handling very large or complex files, as scanning can sometimes take longer.

MetaDefender can handle any traffic and is suitable for any organization regardless of size. With our security requirements, we can achieve this with the existing environment and scale without requiring redesign or re-architecture. Its main advantage is the flexibility in deployment, allowing it to be deployed in the cloud or on-premises. Additional instances can be added as email volume and the number of protected users increases. Overall, I consider MetaDefender to be highly scalable and suitable for any growing organization of any size, with the main requirements being proper planning for traffic and security workloads.

Their customer support is outstanding. Whenever we raise any support case, they provide complete structural descriptions and solutions to the problems we report, and they resolve issues on the spot. I would rate them nine out of ten.

We were previously using Evinent as a security tool, and we incorporated MetaDefender for extensive EDR plus email security.

The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.

We are a customer.

We have reduced some of our manual effort and saved time, even investing additional time on zero-day attacks. In file analysis, we have sometimes saved a lot of time, while also spending a little more on suspicious files. Overall, using MetaDefender has been beneficial and can be justified as a positive investment.

The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.

If you are looking for a solution that enhances your email security or your EDR product, and if you are considering more security solutions that can protect both combinedly, I would recommend MetaDefender as one of the best tools. Its features include multi-scanning, Deep CDR, sandboxing, and file investigation, which are essential for effective detection while minimizing false positives and scanning times. Integration with the existing environment is also important; if you are using Microsoft 365, ensure that flow connectors and policies are planned and tested before moving into production. I would also check for potential conflicts or mail loops if another third-party email security solution is already deployed. Another recommendation is to spend time on policy tuning and user group segmentation. MetaDefender allows policies to be prioritized and applied to specific audiences, making administration much easier as the environment grows. I would recommend this approach as well. My overall rating for MetaDefender is eight out of ten.

Before accessing the company's protected resources, it is being scanned through MetaDefender Endpoint, which scans the local operating system and machine before the request actually hits the company's protected resources.

MetaDefender Endpoint has been installed in the Windows operating system machine, and before accessing any protected resource of the company, MetaDefender scans the request and the resources, and it even scans the local machine. If there is any vulnerability or any kind of malware, then it immediately blocks the resource and does not allow access to the protected resource for the company. In this case, it is the company's protected resource, so access is not allowed. It checks the software and checks the various software that is installed in the machine, and if all are acceptable, then only MetaDefender is allowed to access the protected resources.

For companies that are widely distributed and have resources with company employees widely located across the world, it provides a centralized, secure platform before accessing any protected resource. This is a mandatory software that everyone should install in their machine and ensure that it passes all the quality checks, making it a strong platform in terms of security and securing protected resources.

MetaDefender is fundamentally a security platform. All resources that are company proprietary resources are secured with MetaDefender Endpoint, and this is what was desired at the company level. It is mandatory for each and every resource in the company located across the globe to be scanned by MetaDefender Endpoint before accessing these protected resources.

All employees in the organization are keeping their machines up to date; all software is regularly upgraded. For example, browser versions or other software such as Notepad++ are being upgraded. They are also conducting full Windows scans, meaning they are doing complete security full scans on their machines on a monthly basis because this is set at the organization security policy where it is mandatory to scan the machine once a month. These security policies are implemented, and MetaDefender is valuing these policies and ensuring that all employees are aligning with the security policy.

MetaDefender checks all the software and its latest version, and whether the local software that is installed is aligned with the organization policy that is set by the organization security administrator. MetaDefender passes all this information and checks against those policies that are being set and determines whether the installed software is aligned with the organization policy or not. For example, if any deprecated software or any software that has any kind of malware is in the machine, then it immediately highlights and stops accessing those protected resources.

MetaDefender is always on at startup; it must be enabled during startup of the operating system, and when accessing any protected resource, after authorization and authentication, it immediately checks whether the resource being accessed is allowed for access, and it scans all the software. Whether it is a browser version such as Chrome browser, or if it is having a deprecated or older version, or any operating system software such as WinRAR or Notepad++, any software that is deprecated or has an older version, it will immediately flag that as an error and will not allow access to the protected resources.

This is quite helpful in terms of securing resources; it immediately brings those vulnerabilities or incompatibilities in the system to attention. It also provides the feature to check the status of the operating system or machine status immediately. There is an icon at the taskbar; clicking and rechecking the status of MetaDefender Endpoint shows the current status. If all are acceptable, then it will confirm that all is well, and access to the protected resources can proceed. If there is any issue, it will flag that on the screen when rechecking the status.

MetaDefender highlights all the vulnerabilities the moment of accessing the protected resources, so it scans all the files in the system and brings those issues when clicking the recheck button.

It does the auditing of the local machine and maintains awareness of what is occurring on the machine, specifically from the security perspective. If there is any vulnerability or any kind of malware being deployed in the machine, it immediately stops access to those protected resources.

If there is any major vulnerability, then it is understood that it should not allow access to the protected resource. However, if the vulnerabilities are not serious and are at the information or warning level, then MetaDefender should allow access to those protected resources. For example, if using an older Chrome browser version, it should not be a significant security issue. Similarly, older version Notepad++ represents low priority issues that MetaDefender could still allow employees to access the protected resources, but currently, MetaDefender treats these small issues as high priority.

MetaDefender will not automatically open the screen and display vulnerabilities unless the recheck button is clicked, which is something that could be improved. The moment the operating system or machine is opened, it should highlight any issues if there are vulnerabilities rather than waiting for the recheck button to be clicked.

The recheck button needs to be clicked every time. Additionally, low priority issues are taken very seriously and considered blockers. For example, outdated browser versions or any software in the machine that does not have the latest version could be considered low priority if the software is not critical.

The full scan takes considerable time; a complete Windows full scan takes almost 12 hours because it has billions of files. The full scan is time-consuming, and if MetaDefender could scan it more quickly and provide results faster, that would be an improvement.

Regarding improvements, low priority software that is highlighted as a blocker could be reworked to still allow the user to access the protected resources. Additionally, MetaDefender could introduce some kind of workflow or user interface which highlights all issues or vulnerabilities in one place rather than requiring clicking the recheck button and navigating through the browser.

This product has been in use for two years.

MetaDefender is stable, but it brings or highlights items which are low priority, and software upgrades need to occur very frequently because it checks all the minute details in the operating system and system and brings them forward, necessitating software upgrades.

MetaDefender handles the scale well. There are quite a lot of employees, more than 50,000 employees, and all are using it, making it a quite scalable platform.

Customer service has not been contacted yet because it is a quite stable environment and a stable platform. MetaDefender highlights all the issues and even guides how to resolve vulnerabilities, for example, by installing upgraded software or conducting a full scan. It is quite comprehensive in explaining the issues that are currently encountered.

MetaDefender Endpoint has provided benefit from its use. The company's resources are fully protected and secured; no unauthorized access can reach the protected resources. All resources are now secured, and MetaDefender Endpoint can be trusted in this area.

The setup and pricing are managed at the organization level, and the security department or the infrastructure department would have better knowledge of costing and pricing.

Previously, the authentication and authorization method was using Azure Active Directory, or Azure Entra ID, and now MetaDefender is also used along with Azure AD.

From the security perspective, I would rate it an eight. MetaDefender is on-premises and managed by the company's platform. For any company where resources are widely located across the globe, MetaDefender Endpoint should be considered as one of the security platforms that ensure all protected resources are very much secure.