My main use case for MetaDefender is for our client's environment, which is using MetaDefender for their OT security or for their email side. All clients use MetaDefender, and it is especially great for Content Disarm and Reconstruction, which they want to leverage.

For example, one of our clients is using MetaDefender for their email gateway site as their mail gateways, scanning emails. Generally, they use MetaDefender's Content Disarm and Reconstruction property for that email scanning.

None of my customers are using the reporting and audit visibility features on MetaDefender platform.

Integrating multi-scanning and Content Disarm and Reconstruction positively affects my clients' data security operations, prioritizing security over potential delays experienced by end users.

The best features MetaDefender offers include its Content Disarm and Reconstruction, which is a key feature chosen by our clients because many other products claim to provide that functionality, but generally, they cannot do it as cleanly. Through Proof of Concept sessions with our clients and the OPSWAT team, they see that MetaDefender's Content Disarm and Reconstruction is strong, usable, and valuable for our customers, making them want to work with OPSWAT specifically for this feature.

For example, one of our customers was not using any Content Disarm and Reconstruction technology but was receiving emails containing PDF documents or XLSX documents, some with malicious content. MetaDefender's technology worked effectively, disarming and reconstructing PDFs to deliver clean copies to their users, while allowing their analysts to see the malicious code.

MetaDefender has positively impacted my clients' organizations by saving time for their SOC teams who were previously receiving false positives and unnecessary alarms from other products, allowing them to focus on analyzing real threats, which has led to fewer incidents.

For one of my clients, a major bank in Turkey, they reported saving approximately 30 percent of their SOC time on analyzing emails since implementing MetaDefender.

MetaScan multi-scanning feature is excellent because it provides multiple vendors for scanning. If one vendor fails, the others remain operational, ensuring continued protection.

Assessing the effectiveness of Deep Content Disarm and Reconstruction in reconstructing files safely and without signatures reveals it to be effective, as clients receive identical documents without changes other than the removal of malicious code.

MetaDefender's file-based vulnerability assessment analyzes binaries and installers for known vulnerabilities before they enter a network, providing a proactive defense that is highly valuable for our customers.

While MetaDefender's mail gateway already gives fewer false positives, there is still room for improvement in reducing those even further.

Additionally, MetaDefender could benefit from a better graphical user interface for administrators, making it more usable, although this is not an urgent need but an area for potential improvement.

I have been using MetaDefender for three years.

It was a fresh sell to our customers for MetaDefender, and I evaluated other options before choosing MetaDefender.

I have not seen a direct return on investment, but clients have noted that the product saves time and may reduce the need for fewer employees since the SOC team focuses on critical incidents as MetaDefender handles current analyses efficiently.

Pricing, setup costs, and licensing are handled by my sales team, but feedback indicates that our pricing is better than other vendor solutions.

I can specify that my clients considered other options before choosing MetaDefender.

I do not have anything else to add about how my clients use MetaDefender. My review rating for MetaDefender is ten out of ten.

MetaDefender is used in one of our client environments where every file upload to their web portal goes through the scanning process. It scans using multiple engines and applies CDR before allowing the file into the system. This has helped us stop suspicious documents even before users interface with them.

With the increase in phishing and document-based attacks recently, this kind of file sanitization layer has become very important for us.

MetaDefender offers some of the best features such as multiple engine malware scanning, content disarm and reconstruction (CDR), deep file inspection, and strong API-based integrations. Deep file inspection is the feature I find myself using the most, as it helps in my workflow significantly. The multi-engine approach gives more confidence compared to relying on a single antivirus engine, especially for zero-day threats.

MetaDefender's effectiveness in blocking or sanitizing content based on policy is very strong. A combination of multi-engine scanning and CDR makes a big difference. It does not just rely on a signature; it enforces policy at the file level. Policies like blocking files with high-risk indicators, sanitizing documents with embedded macros, and allowing only clean files into the environment show its strengths. MetaDefender is very effective in sanitizing files without breaking usability. The integration of multi-scanning and Content Disarm and Reconstruction affects our data security operations. MetaDefender plays a very important role in today's threat landscape, which heavily uses documents and file-based payloads.

The UI can be more user-friendly, and initial steps and policy tuning take some time. Reporting can be improved as extracting detailed insights for management reports takes extra effort.

I have been using MetaDefender for 1.5 to 2 years.

MetaDefender is stable. We have not faced major downtime.

MetaDefender's scalability is excellent, as it handles larger volumes of file scanning without major issues.

Support for MetaDefender is very responsive, though sometimes complex issues take time to resolve.

We evaluated sandbox-based solutions and some email security tools, but MetaDefender's CDR approach was more practical.

MetaDefender has positively impacted my organization by reducing the risk of file-based attacks, which has significantly improved our overall defense against phishing and malware delivery techniques. We have seen around a 40% drop in malicious file incidents, and our SOC team is spending less time on manual file analysis now.

MetaDefender is a very time-saving and effort-saving tool. I advise others looking into using MetaDefender to understand their file flow properly before deployment. If integrated correctly, it becomes a very strong layer against modern file-based attacks.

Threats in a file are cleaned before they reach the core, creating a silent shield in place. The SOC workload has reduced because fewer suspicious files reach analysis, and users do not complain much since files still open normally after sanitization. I would rate this review an 8.

I primarily use it for file security and malware analysis, helping me scan files, detect threats, and validate suspicious attachments before they reach end users. The multi-engine scanning and sandbox analysis provide an extra layer of security to the environment, ultimately improving detection capability and reducing the risk of malware infection.

One instance involved a user receiving a suspicious email attachment that appeared normal, but MetaDefender flagged it through one of its engines, leading to a deep analysis that revealed it was malicious. This helped us block the file before it reached end users.

Another important use case is that it helps us scan email attachments and downloadable files using its sandbox capability, detecting malware with multiple antivirus engines and validating suspicious files during investigations. As a SOC team, whenever we receive a suspicious file or alert, we use MetaDefender to analyze it before taking any action.

The best features of MetaDefender include strong sandbox analysis, file reputation, threat intelligence, and data sanitization, which removes hidden threats from files and provides better confidence during investigations. Rather than relying on a single antivirus engine, MetaDefender checks files using multiple engines, which truly helps.

I find myself relying most on sandbox analysis and file reputation, which are two features I genuinely appreciate from this tool. The sandbox analysis, file reputation, and threat intelligence stand out as key features.

MetaDefender positively impacts the organization by reducing the risk of malware entering our security environment, providing faster file analysis during incidents, and improving our confidence when handling suspicious attachments. Sometimes, files that traditional scanners deem safe may contain malicious elements, so using MetaDefender gives us the assurance we need when investigating malware or attachments.

The Deep CDR feature effectively removes risky content and rebuilds safe files, neutralizing even unknown threats. Unlike signature-based detection that only addresses known threats, CDR works by eliminating suspicious content, making it superior in practical scenarios where files such as PDFs and Office documents can be safely delivered to users without risk while maintaining usability.

I think scanning time can sometimes be a bit slow for larger files, and the user interface could be improved. The licensing cost is somewhat high for smaller organizations like ours, so these are my personal suggestions for improvement.

They should consider integrating live threat intelligence data so that if any attachment is detected in a security environment somewhere in the world, it could show where else this file has been delivered.

I would rate MetaDefender an eight out of ten, primarily because it experiences slight delays in scanning larger files, and both the user interface and pricing could be optimized.

I have been using MetaDefender for two years.

MetaDefender has very good stability with no major issues.

In terms of scalability, MetaDefender is well-suited for enterprise environments.

Previously, we used traditional antivirus solutions that utilized only single engines, which is why we switched to MetaDefender, as it offers numerous features and capabilities that are advanced compared to traditional antivirus solutions.

We see a return on investment as MetaDefender prevents malware incidents, saves investigation time for SOC analysts, and reduces the overall impact of threats. This indirectly saves costs and efforts for organizations that implement it.

The pricing of MetaDefender is on the higher side, especially for startups like ours, and the integration with email security file upload systems functions well. The cost depends on the number of engines purchased and the features chosen, but for those considering multi-layer security, it is worth it for enterprises.

Before choosing MetaDefender, we evaluated basic antivirus and file scanning solutions that were already part of our environment. These tools only provided single-engine detection and were limited in their coverage and advanced features such as multi-engine scanning and CDR. MetaDefender was ultimately selected for its comprehensive approach that combines multiple antivirus engines and sandbox analysis with file sanitization.

The file-based vulnerability assessment feature in MetaDefender is very valuable for identifying vulnerabilities before deployment, especially in environments where files or applications are frequently shared. It detects outdated components, known vulnerabilities, or risky configurations within files prior to execution, which is essential since many vulnerabilities arise from outdated libraries or insecure files. From a SOC perspective, this feature offers a proactive layer of security, enabling teams to identify and fix issues before they escalate into incidents.

We use the audit visibility feature in MetaDefender, which helps during audits by providing reports that demonstrate which files were scanned and what threats were identified. This is particularly useful when explaining our security protocols to client-side technicians. For example, during an audit, we can show the report of scanned files as proof that our security checks are in place.

From my experience, MetaDefender is quite effective in blocking and sanitizing content based on defined policies, allowing organizations to set rules for file handling such as blocking high-risk files and sanitizing them with CDR before delivery. This is crucial because it ensures that even if files contain hidden threats, they can be reconstructed safely for sharing. For the SOC, this minimizes the risk of malware reaching end users and allows for flexibility in fine-tuning policies based on our security environment. In practice, it automates decision-making, reducing the need for manual analysis and enforcing strong security policies.

For organizations dealing with email attachments and file uploads or downloads, my advice is that MetaDefender is a very useful tool as it adds an extra security layer and assists SOC teams in validating threats more confidently.

During my use, I have not observed any major downtime or performance issues. Overall, MetaDefender is a strong solution for file security, especially for handling email attachments and downloadable files. The multi-engine scan and CDR feature provide an extra layer of protection, effectively preventing both known and unknown threats. I would rate this solution an eight out of ten overall.

MetaDefender serves as a file security gateway that scans, cleans, and sanitizes files before they are allowed on the network, which stops malware, ransomware, zero-day attacks, and any kind of malicious files from entering the network.

For one of our partners, we were dealing with a large financial services business handling mortgage applications. When files were scanned into the network, every single file that was sent was then scanned by the multi-scanner, and if any contained even a slight amount of malware, we performed deep CDR file sanitization that removed everything that could be malicious and rebuilt the file.

The main use cases that we tend to see are all the antivirus engines as part of the multi-scan, and the second use case that is emerging frequently is file sanitization, also known as deep CDR.

In my experience, the best features MetaDefender offers include the number of different antivirus engines that can scan files through multi-file scanning, often using 20 to 30 engines, with the top premium package around 33 engines, capturing 80 to 90% of malware in all those files. If any engine detects malware, the file is blocked, which increases detection because different engines catch different malware.

When dealing with central government and defense, we find that if there is any kind of malware on the network or the file, whether that is a software file, hard disk file, or a pen drive, it cannot be allowed on the network. This is when we put it into the sandbox and perform file sanitization to ensure that nothing malicious comes into the network.

Whenever we are dealing with central government or defense contracts, MetaDefender's core philosophy of trusting no file means it scans files, rebuilds them, and verifies their reputation, ensuring they contain no malicious content. This positively impacts our organization by detecting malware and stopping any kind of data leaks through the network.

In terms of measurable outcomes across central government and defense, we are seeing saved time when files go through the antivirus file scanners. In financial services, such as with mortgage applications, the process sends files straight into MetaDefender file scanning that cleans out any malicious content.

I don't think there are many feature improvements needed; it's a great solution. The main thing is just the pricing because it's such a top-end enterprise product. For smaller partners with a customer base that isn't as affluent, the price can be a barrier, making it more of a 'nice-to-have' for their budgets compared to cheaper competitors.

I've been using MetaDefender for just under 18 months.

MetaDefender is 100% stable, making it one of the best cybersecurity solutions we offer, which provides confidence in promoting and recommending it to others.

MetaDefender's scalability is considerable. We handle vast amounts of traffic from banking, defense, and critical national infrastructure, ensuring that even one malicious file does not enter our networks.

Customer support from Opswat is commendable. Their customer service team, distribution team, and regional sales managers provide excellent aftercare and set us up for upselling across the entire MetaDefender portfolio.

From a partner's perspective, the channel team and customer service have delivered strong support. I would rate it a nine because I have not interacted with customer support directly, though the support provided has been strong.

We have not used a different solution. We focus on best-in-breed vendors, with Opswat being our chosen solution due to its effectiveness in the market.

I believe we see a return on investment through time savings and reduced need for unnecessary personnel. Having both cloud and on-premise solutions enables effective file sanitization and vulnerability detection while preventing attacks that save costs and protect reputation.

Regarding pricing, setup cost, and licensing, I find the pricing for kiosks, cloud, deep CDR, and adaptive sandbox appropriate. We are seeking more service partners for Opswat's professional services to ensure smooth implementation.

Before choosing MetaDefender, we considered alternatives such as Reversing Labs but found their offerings to be inferior, especially for our defense and central government contracts, where Opswat stands out as far superior.

To achieve a perfect score of 10, MetaDefender would need to cater to every partner's ability to sell. While the price is a consideration, the benefits of scanning, removing, detecting, and sandboxing outweigh it significantly.

I advise those considering MetaDefender to reach out to reseller partners for guidance on file sanitization and to explore setting up a proof of concept to see the value MetaDefender brings, with demos available directly on their website.

My overall rating for this solution is 9.

I deploy it in different environments and manage a team of professional services that deploy MetaDefender products in customer environments. I talk with customers and am aware of use cases where new or additional needs arose after MetaDefender deployment. For example, customers needed to transfer files between source and destination using MetaDefender. I know that MetaDefender File Transfer Protocol, or MFT, is now supported, but in the past, it was not. There are products that have been developed from customer needs, such as products that can transfer files from source to destination with integration to MetaDefender.

The detection rate of the MetaScan multi-scanning feature is very high. When discussing Linux with five engines or ten engines, it can detect most of the viruses that are tested. I have seen very few instances where customers reported a virus that was not blocked after a PT scan. When we verify these cases, we confirm they occurred. Of course, every engine has its own detection rate, and you cannot achieve 100 percent detection. When using MetaDefender especially on Windows, the detection rate is very high, and it increases as you use more engines. Most customers I see using eight or twelve engines on Windows have good results with both configurations. When customers use a large number of engines, such as twenty engines with integration to external scanners, the results look almost perfect because in cyber security, there is no 100 percent, but it is close to that.

The effectiveness of Deep CDR in reconstructing files safely and without signatures is very effective. When people configure Deep CDR correctly, it performs as it should. Sometimes some files are negatively affected by CDR. If I must be specific about what could be helpful, it would be to create a policy or workflow in OPSWAT terminology that handles cases when CDR cannot be performed or harms the file. I am not certain if the system can check whether CDR has harmed a file, but I know of use cases where CDR was disabled because it made files unable to open or unable to open properly. I believe this is very effective and is the most effective engine of OPSWAT because customers ask for OPSWAT for two main reasons: the CDR capabilities and the multi-scanning engines.

Some feedback indicated that it takes too much time to configure certain policies because there are many options. Some people appreciate this because you can configure anything, but I believe MetaDefender should have a wizard or general policies that can be used for 80 percent of customers.

I use the expanded file type and archive coverage feature sometimes, especially for customers who try to scan large archives with the deep scan capabilities of OPSWAT and Deep CDR. This provides full protection because it scans every single file, but sometimes it takes too long. When discussing CAB files or archives for patching or server updates and BIOS updates and operating system updates, the scanning process takes too long, and it was difficult for customers who sometimes decided not to scan because the scanning time was excessive.

I use the reporting and audit visibility features. Some capabilities are lacking in reporting because we do not have full statistics that are easy for users to understand. If something requires checking and then referring to documentation to understand it, that is too much for most users. When looking at one of the statistics, you can see how many files have been scanned and then you see a number out of 500 or a different number if you change it. It is not a number of files or scan processes; it is a number of files inside a file. When you scan a PowerPoint presentation file, for example, it counts as forty different files because of all the sub-files. I understand from customers that when they look at the visualization data or statistics, they do not understand what is happening there.

Most customers I see do not use the file-based vulnerability assessment feature. It has some good results about vulnerabilities, but I am not certain if it is that helpful because many organizations, when they deploy a file and see that there are vulnerabilities, still deploy it because it is part of the code. It can produce results, but those results do not cause any action. Many products have something more advanced than vulnerabilities and static scoring. They have tools that can inform you about a vulnerability, whether the vulnerability is exploitable, if it is weaponized, and if someone can use this vulnerability in your environment. The file-based vulnerability feature works, but for most people, they do not take any action based on the results or block files because of file-based vulnerabilities.

I have used MetaDefender for one and a half years.

The stability of the system is very high. I have not experienced crashes or downloads when the server is rebooted, and the server runs well after rebooting. I have not seen errors frequently. I recall one problem with MetaDefender email where there was an unusual issue with some connections remaining open, but I found this kind of problem only once. Most of the time, it is very stable, and you can rely on MetaDefender Core and also email. The stability problems with OPSWAT occurred when they attempted to migrate one product, such as the email product, to a SaaS service; it was not stable in that environment.

MetaDefender is very scalable. From what I understand, when you use one database for all instances, you can deploy ten different servers or ten different instances with a separate database for each one. You cannot check the status of scans in each one; you have to check each specific instance. When discussing a shared database, it is scalable, but the performance is harmed. I do not know the specific impact, but it is just a feeling I have.

I have contacted the technical support of OPSWAT. The quality of answers from support has been very good most of the time. It can be useful when contacting support to mention what needs to be collected and what needs to be sent before opening the ticket. For example, if discussing an issue, support will probably ask for specific logs. This can save time because many vendors, when they check something and ask for logs, need those logs from the beginning. If you open a ticket and the answer is to proceed, and the answer after one day is that specific logs are needed, it is better to know that from the beginning.

The deployment of MetaDefender on Windows and Linux machines is very easy and quick. When discussing deployment of containers or deployment in Kubernetes environments, it sometimes takes too long. The deployment of the sandbox product takes too long. The deployment of MetaDefender email security, core, and MetaDefender kiosk has very easy and quick deployment.

One person can deploy MetaDefender. It is one of the products that can be managed by one person and managed easily, including the deployment.

The pricing of MetaDefender is about hundreds of dollars. If I remember correctly, when someone attempted to buy from us one instance of OPSWAT, it was about nine thousand dollars for multi-scanning with eight engines and also the CDR module. The pricing is good, but when you add additional engines, this is what causes most people not to use additional features. Every additional engine, not about scanning engines but other engines such as file-based vulnerabilities and so forth, requires another license. If customers could buy in one price the basic package, which includes CDR and multi-scanning, in one price, many people would prefer to do it. However, when it is necessary to pay for every single engine or single feature, I believe most customers do not want to use it for that reason.

I have used alternatives to MetaDefender, but not as an administrator, only as a user. I used some kiosk products similar to MetaDefender kiosk. There is an alternative called Sasa Software, I believe it is Sasa Scanner or Gateway Scanner. I used it, but the user interface is not as good as OPSWAT. The experience with this product is not as good as the experience with OPSWAT, and the time it took to scan some large files was very long. OPSWAT is the best alternative. I also see on customers' side another product called RESEC, and this product also was not a good experience. The user experience is not good enough in this field, and when users try to configure policies, it lacks features when compared to OPSWAT.

The sandbox helps in cases of suspicious files. However, the sandbox alert indicates suspicious activity for many different files. When we test some files that we download from vendors' official sites for server BIOS upgrades or firmware upgrades on servers, such as files from Dell or HPE, these files are also considered suspicious for many use cases. The sandbox is good only for specific areas. If discussing email, it can be good. However, if discussing large files, the sandbox can indicate suspicious activity in almost every executable file. This causes customers not to believe in the results. They say it is suspicious, but it is fine to them. Even if something is actually suspicious, it does not receive attention because of the many files that should be legitimate but are considered suspicious.

Perhaps the effectiveness of the sandbox and level of suspicious files can have two different levels. If asked how it can be better, a different score or different tag for suspicious files from known vendors and suspicious files from unknown vendors could help. Multiple levels of suspicious files, scores, or tags could be something that can be configured. For example, when using the sandbox to scan files that you download from the internet to different environments, such as air gap environments, and in this environment you manage IBM servers, if you scan the file and select that you are using it for IBM servers before scanning, it could be considered less suspicious. The system could also load a certificate of the file that you download and then determine whether it has a trusted certificate or a certificate that is probably good enough or probably not suspicious most of the time.

I am not certain if MetaDefender can do anything else. Perhaps if they want to improve vulnerability management, instead of managing static CVEs, they could have a different method involving CVEs but something else as well. For example, CVEs that can be harmful because they are exploitable could be differentiated. However, this is something that cannot be managed at the MetaDefender level because it is just about files on a perimeter and does not understand the deployment of the environment because it is not running in the real environment. I am not certain if there is a way to do this better.

There are some upgrades when MetaDefender has new features, so you have to upgrade. This is not about the upgrade of the engines that happen all the time if you have an internet connection or do it manually. The maintenance can take significant effort that causes most people not to upgrade and update it all the time. Considering offline users, offline environments, and environments with no internet, easier updates could be helpful. The upgrade of MetaDefender version, whether email or MetaDefender Core, is very quick. I would rate this review eight out of ten.