MetaDefender ICAP Server Windows (BYOL AMI)

The main use case for MetaDefender in the project with Bajaj is to ensure that files are scanned before sending them to the server, where I created a Java-based service that checks for viruses.

In the project with Bajaj, my main use case for MetaDefender is to scan files that use Excel uploads and basic file uploads to prevent any virus infections, so I send the file bytes to MetaDefender APIs and check for viruses.

I do not know much about Deep CDR, as my integration is mostly for scanning viruses, and we just block files that are corrupted or harmful without reconstructing them.

MetaDefender has positively impacted Bajaj's organization, as their security has increased significantly by scanning all the files in their environment before sending them to the servers.

I cannot share any specific outcomes or benefits that Bajaj has seen, as that is an internal organization matter.

In my experience, the best feature that MetaDefender offers is its perfect documentation, which is critical for API integrations to ensure files are not corrupted or infected with viruses.

I would add that for the dashboard, while I have used it, I am more fascinated about the API. It is good that we can manage users from one console, and I can see the history of uploads and whether the files are corrupted or not.

I think the detection rates provided by MetaDefender through multi-scanning are good, as it stops almost all of the virus files I have uploaded.

MetaDefender effectively blocks the harmful content based on our policies, as this is working perfectly fine for me, though I cannot share specific policies.

In my opinion, MetaDefender could improve its async version of their APIs, as the documentation is not that good for the async APIs and can be a bit complex to navigate for integrations.

Regarding needed improvements for MetaDefender, I think the dashboard could benefit from features that allow tracking IPs from where files are coming, which would enable blocking potential attackers.

I reported this issue, and while it is not directly MetaDefender's fault, it highlights a potential area where they could prevent misconfigurations.

I have been using MetaDefender for a project with an Indian client named Bajaj, which is a big client, and they have requested us to integrate MetaDefender with their current flow.

I think MetaDefender works as expected without major issues, and I faced one, but it was due to the integration provider, OPSWAT.

There was an incident regarding the sending of hardcoded API keys, which caused me to receive unauthorized errors due to the overriding API key issue from OPSWAT.

In my experience, MetaDefender has been stable, as I have not noticed any downtime while my application uses it 24/7.

I do have concerns about scanning larger file sizes, like 400 MB, since we have set a maximum limit of 65 MB, and I would be worried if we were to increase this limit.

I have not had to reach out to MetaDefender for customer support.

I did not use a different solution before MetaDefender, as there was no prior solution.

I think my use case with MetaDefender fits into my workflow well, as it is quite easy to integrate, thanks to the thorough documentation, and we took about two or three days to integrate all of MetaDefender's APIs.

I have not seen a return on investment regarding time or money, but the implementation of MetaDefender provides an essential security layer that blocks potential threats.

Regarding pricing, setup cost, and licensing, I cannot provide specifics since it falls under Bajaj and OPSWAT's management, but from my perspective, the per API hit cost is a factor.

Before choosing MetaDefender, I did not evaluate other options, as it was a decision made by the higher management, and my role was to integrate it.

I would rate MetaDefender around seven to eight because I have used their file scan feature, though I have not fully explored all their capabilities. I would give it a seven or eight because I have not used all the functionalities provided, and I deduct a point for the async API documentation which could be better.

Regarding MetaDefender's AI capabilities, I believe they manage governance and security policies quite well, especially since Bajaj is a large and reputable firm.

MetaDefender is deployed on-premises in the organization, and there is also a trial version available on the cloud, but we are currently only using on-premises.

My advice to others looking into using MetaDefender is to read the documentation first before implementing anything. I would rate MetaDefender an eight out of ten overall.

Before accessing the company's protected resources, it is being scanned through MetaDefender Endpoint, which scans the local operating system and machine before the request actually hits the company's protected resources.

MetaDefender Endpoint has been installed in the Windows operating system machine, and before accessing any protected resource of the company, MetaDefender scans the request and the resources, and it even scans the local machine. If there is any vulnerability or any kind of malware, then it immediately blocks the resource and does not allow access to the protected resource for the company. In this case, it is the company's protected resource, so access is not allowed. It checks the software and checks the various software that is installed in the machine, and if all are acceptable, then only MetaDefender is allowed to access the protected resources.

For companies that are widely distributed and have resources with company employees widely located across the world, it provides a centralized, secure platform before accessing any protected resource. This is a mandatory software that everyone should install in their machine and ensure that it passes all the quality checks, making it a strong platform in terms of security and securing protected resources.

MetaDefender is fundamentally a security platform. All resources that are company proprietary resources are secured with MetaDefender Endpoint, and this is what was desired at the company level. It is mandatory for each and every resource in the company located across the globe to be scanned by MetaDefender Endpoint before accessing these protected resources.

All employees in the organization are keeping their machines up to date; all software is regularly upgraded. For example, browser versions or other software such as Notepad++ are being upgraded. They are also conducting full Windows scans, meaning they are doing complete security full scans on their machines on a monthly basis because this is set at the organization security policy where it is mandatory to scan the machine once a month. These security policies are implemented, and MetaDefender is valuing these policies and ensuring that all employees are aligning with the security policy.

MetaDefender checks all the software and its latest version, and whether the local software that is installed is aligned with the organization policy that is set by the organization security administrator. MetaDefender passes all this information and checks against those policies that are being set and determines whether the installed software is aligned with the organization policy or not. For example, if any deprecated software or any software that has any kind of malware is in the machine, then it immediately highlights and stops accessing those protected resources.

MetaDefender is always on at startup; it must be enabled during startup of the operating system, and when accessing any protected resource, after authorization and authentication, it immediately checks whether the resource being accessed is allowed for access, and it scans all the software. Whether it is a browser version such as Chrome browser, or if it is having a deprecated or older version, or any operating system software such as WinRAR or Notepad++, any software that is deprecated or has an older version, it will immediately flag that as an error and will not allow access to the protected resources.

This is quite helpful in terms of securing resources; it immediately brings those vulnerabilities or incompatibilities in the system to attention. It also provides the feature to check the status of the operating system or machine status immediately. There is an icon at the taskbar; clicking and rechecking the status of MetaDefender Endpoint shows the current status. If all are acceptable, then it will confirm that all is well, and access to the protected resources can proceed. If there is any issue, it will flag that on the screen when rechecking the status.

MetaDefender highlights all the vulnerabilities the moment of accessing the protected resources, so it scans all the files in the system and brings those issues when clicking the recheck button.

It does the auditing of the local machine and maintains awareness of what is occurring on the machine, specifically from the security perspective. If there is any vulnerability or any kind of malware being deployed in the machine, it immediately stops access to those protected resources.

If there is any major vulnerability, then it is understood that it should not allow access to the protected resource. However, if the vulnerabilities are not serious and are at the information or warning level, then MetaDefender should allow access to those protected resources. For example, if using an older Chrome browser version, it should not be a significant security issue. Similarly, older version Notepad++ represents low priority issues that MetaDefender could still allow employees to access the protected resources, but currently, MetaDefender treats these small issues as high priority.

MetaDefender will not automatically open the screen and display vulnerabilities unless the recheck button is clicked, which is something that could be improved. The moment the operating system or machine is opened, it should highlight any issues if there are vulnerabilities rather than waiting for the recheck button to be clicked.

The recheck button needs to be clicked every time. Additionally, low priority issues are taken very seriously and considered blockers. For example, outdated browser versions or any software in the machine that does not have the latest version could be considered low priority if the software is not critical.

The full scan takes considerable time; a complete Windows full scan takes almost 12 hours because it has billions of files. The full scan is time-consuming, and if MetaDefender could scan it more quickly and provide results faster, that would be an improvement.

Regarding improvements, low priority software that is highlighted as a blocker could be reworked to still allow the user to access the protected resources. Additionally, MetaDefender could introduce some kind of workflow or user interface which highlights all issues or vulnerabilities in one place rather than requiring clicking the recheck button and navigating through the browser.

This product has been in use for two years.

MetaDefender is stable, but it brings or highlights items which are low priority, and software upgrades need to occur very frequently because it checks all the minute details in the operating system and system and brings them forward, necessitating software upgrades.

MetaDefender handles the scale well. There are quite a lot of employees, more than 50,000 employees, and all are using it, making it a quite scalable platform.

Customer service has not been contacted yet because it is a quite stable environment and a stable platform. MetaDefender highlights all the issues and even guides how to resolve vulnerabilities, for example, by installing upgraded software or conducting a full scan. It is quite comprehensive in explaining the issues that are currently encountered.

MetaDefender Endpoint has provided benefit from its use. The company's resources are fully protected and secured; no unauthorized access can reach the protected resources. All resources are now secured, and MetaDefender Endpoint can be trusted in this area.

The setup and pricing are managed at the organization level, and the security department or the infrastructure department would have better knowledge of costing and pricing.

Previously, the authentication and authorization method was using Azure Active Directory, or Azure Entra ID, and now MetaDefender is also used along with Azure AD.

From the security perspective, I would rate it an eight. MetaDefender is on-premises and managed by the company's platform. For any company where resources are widely located across the globe, MetaDefender Endpoint should be considered as one of the security platforms that ensure all protected resources are very much secure.

My main use case for MetaDefender is for security purposes, as we are a cybersecurity team, and currently we are using it for purposes such as antivirus scanning and other security measures.

In my day-to-day work, we are working with a company called Opswat, and we have devices, so to keep everything clean and clear, we are using MetaDefender as an antivirus firewall. We are inserting this MetaDefender chip for scanning purposes and using it as a firewall as well, but I do not have much knowledge about it because I am in a non-technical role right now.

In terms of using MetaDefender, we are utilizing it for threat detection, multi-scanning, and enterprise security.

MetaDefender has impacted my organization positively by adding an extra layer of security to our file and content handling process, and through its CDR, it ensures that files are sanitized before they reach our environment, which has improved our security posture.

I have noticed that the confidence and security of file processing have improved, with multi-engine scanning providing threat detection, and the security checks help us identify malicious files before they enter our environment, although I have not yet observed a specific, quantified business impact.

In my experience, MetaDefender offers a Deep CDR, and other major strengths include multi-scanning, Tri-tech AI, Adaptive Sandbox, Proactive DLP, and file vulnerability assessment.

Out of those features, I find myself relying on Deep CDR the most because it is one of MetaDefender's key differentiators; it does not depend only on detecting known malware but sanitizes and reconstructs files to prevent potentially malicious content, including zero-day threats, from reaching the environment.

Regarding MetaDefender's AI features, I think it handles data responsibly and keeps things secure by providing protection in multiple layers through malware scanning, threat detection, and content sanitization, which helps organizations manage security risks while maintaining a good balance between security, control, and compliance.

I find MetaDefender's AI capabilities to be reliable and useful as an additional layer of threat detection, with results that have been generally consistent and provide useful insights when analyzing files, though I have not used the AI capabilities long enough to independently measure accuracy.

My impression of the detection rates from MetaDefender's Metascan Multi-scanning has been positive; using multiple scanning engines provides broader coverage and greater confidence that potential threats will not be missed, and while I have not independently measured the detection rate, the results I have seen are consistent and useful for identifying potential malicious files.

I assess Deep CDR as highly effective in reconstructing files safely and without signatures because it focuses on safely reconstructing files rather than relying only on traditional malware signatures, which is particularly valuable for handling unknown or potentially zero-day threats while keeping reconstructed files usable.

I think the file-based vulnerability assessment feature is valuable because it helps identify potential vulnerabilities before files or applications are deployed, providing an additional preventive security layer that helps organizations address risk earlier rather than discovering them post-deployment.

We are using the reporting and audit visibility features to gain better visibility into scanning activities and results, which help provide a clearer record of what has been scanned and the outcomes, aiding in tracking and audit purposes from an operational perspective.

One area where MetaDefender could improve is by making the user experience more intuitive, especially for new users, with clear guidance, simpler navigation, and a more detailed explanation of scan results and outcomes, which would enhance the effectiveness for users, while better onboarding and learning resources would help users get familiar with the different features more quickly.

The usability and onboarding are my main concerns, as I do not have much overview on the technical aspects.

I have been using MetaDefender for two to three months.

MetaDefender offers strong security capabilities and multiple layers of threat detection, but since I am still relatively new to this platform, I would explore more of its features before giving it a higher rating. Even though MetaDefender provides a strong, multilayered security and is quite useful and comprehensive, the user experience on onboarding and the clarity of scan results could be simpler, especially for new users.

My advice to organizations looking into using MetaDefender is to seek an additional layer of security around file and content handling, as it is a great choice with multi-engine scanning, CDR, and vulnerability assessment capabilities providing good overall coverage. It is important to clearly understand your organization's security requirements and take time to explore the different features and integrations to get the most value from the platform.

I would rate MetaDefender as an eight out of ten.

My main use case for MetaDefender is for multi-scanning purposes, including Deep CDR, sandbox-based analysis, and protecting the organization from malware and other file-based threats delivered through email, particularly suspicious or unknown attachments. I primarily view it as an additional inspection layer for email attachments, using its multi-scanning capability to analyze files with multiple detection engines. The Deep Content Disarm and Destruction capability is also valuable because it can remove potentially malicious content from supported files and provide a safer version for the user. From a SOC's perspective, this is particularly useful for handling files that may bypass traditional signature-based security controls while email filtering is happening. It gives us additional confidence when dealing with documents such as PDFs and Office files and all other materials that we receive through email. MetaDefender prevents malicious or weaponized files from reaching users while reducing the risk associated with unknown, zero-day file-based threats.

The best features of MetaDefender include multi-scanning, multi-layered scanning of any email or attachment, the CDR feature, and the sandboxing analysis capability. The multi-scanning feature is particularly useful because a file can be checked against multiple antivirus engines instead of relying on a single detection engine. Deep CDR is one of the strongest features because instead of only detecting whether the file is malicious, it can sanitize supported files by removing potentially dangerous content and reconstructing a safe version. This is especially useful for documents and email attachments where we still need to allow the business to work with the file. The adaptive sandbox is another valuable feature for files that require deeper behavior analysis, providing another layer for identifying suspicious or malware-like content that may not be obvious through the traditional scanners that we use.

MetaDefender has a positive impact by adding multiple layers of file scanning, email classification, and attachment investigation in a more efficient way. Instead of just relying on the verdict from our primary email or endpoint security solution, we can use MetaDefender to get additional analysis across multiple engines. This is especially helpful when dealing with suspicious or previously unseen files, zero-day attack files. Deep CDR has also been useful from a risk reduction perspective because potentially dangerous content can be removed from supported files while still allowing users to work with a usable version of the document. Overall, MetaDefender has a positive impact on analysis and detecting suspicious files, leading to greater confidence in our environment. It has also helped reduce some of the manual efforts involved in determining whether the attachment is safe or not.

MetaDefender is quite better in all aspects it has been designed for. We could enhance the user interface and user experience, as the platform has many security capabilities, but some configuration and policy management tasks can take time to understand, especially for someone using the product for the first time. I would appreciate more intuitive reporting and dashboards. The security information is useful, but making key metrics, detection trends, false positives, and remediation actions easier to understand would help a SOC team quickly identify areas requiring attention. Another area for improvement would be reducing false positives and improving processing time for large or complex files, which sometimes may require additional manual review. The CDR is a very useful tool, but clearer handling and exception management should be implemented when sanitizing legitimate files. Automation and integrations could also be enhanced, particularly around recommending appropriate actions based on scan results and simplifying integration with other security tools.

We have been using MetaDefender for more than two years.

From my overall experience, MetaDefender is a very stable and reliable product when it comes to the outcomes of file analysis and email attachments received. In my day-to-day experience, I have not encountered any major stability issues that would significantly affect email or file security operations. The core functions, such as multi-scanning, sandboxing, and file inspection, have been consistent. Once the policies and integrations are configured properly, there is minimal ongoing maintenance required to keep the solution operational. I would monitor its performance when handling very large or complex files, as scanning can sometimes take longer.

MetaDefender can handle any traffic and is suitable for any organization regardless of size. With our security requirements, we can achieve this with the existing environment and scale without requiring redesign or re-architecture. Its main advantage is the flexibility in deployment, allowing it to be deployed in the cloud or on-premises. Additional instances can be added as email volume and the number of protected users increases. Overall, I consider MetaDefender to be highly scalable and suitable for any growing organization of any size, with the main requirements being proper planning for traffic and security workloads.

Their customer support is outstanding. Whenever we raise any support case, they provide complete structural descriptions and solutions to the problems we report, and they resolve issues on the spot. I would rate them nine out of ten.

We were previously using Evinent as a security tool, and we incorporated MetaDefender for extensive EDR plus email security.

The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.

We are a customer.

We have reduced some of our manual effort and saved time, even investing additional time on zero-day attacks. In file analysis, we have sometimes saved a lot of time, while also spending a little more on suspicious files. Overall, using MetaDefender has been beneficial and can be justified as a positive investment.

The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.

If you are looking for a solution that enhances your email security or your EDR product, and if you are considering more security solutions that can protect both combinedly, I would recommend MetaDefender as one of the best tools. Its features include multi-scanning, Deep CDR, sandboxing, and file investigation, which are essential for effective detection while minimizing false positives and scanning times. Integration with the existing environment is also important; if you are using Microsoft 365, ensure that flow connectors and policies are planned and tested before moving into production. I would also check for potential conflicts or mail loops if another third-party email security solution is already deployed. Another recommendation is to spend time on policy tuning and user group segmentation. MetaDefender allows policies to be prioritized and applied to specific audiences, making administration much easier as the environment grows. I would recommend this approach as well. My overall rating for MetaDefender is eight out of ten.