MetaDefender ICAP Server Windows (BYOL AMI)

MetaDefender is used to inspect every file before it enters our environment. Whenever customers upload documents through online banking, send email attachments, or when we are exchanging files, MetaDefender automatically scans those files before they are delivered to our users or into our internal systems. It uses multi-scanning to check each file with multiple antivirus engines at the same time. If a threat is detected, the file is blocked or quarantined according to our security policy.

For documents such as Word, Excel, and PDF files, we use its deep CDR, content disarm and reconstruction, to remove risky content such as macros, vendor scripts, or active projects, creating a cleaner version that employees can safely open. We also use its threat intelligence to compare files against known malware or ransomware. This is advantageous because it helps us identify malicious files quickly before they spread through our systems.

Another important use is vulnerability assessment, where the platform checks our endpoints and servers for outdated software, missing security patches, and known vulnerabilities, providing us with a report. This is beneficial in helping us reduce risks before they can be exploited.

File analysis and reporting are very important to us because they provide detailed information about each candidate file. The results include threat classification and associated recommendations. Threat intelligence helps us identify files connected to known malware and other threats, improving our detection ability. The multi-scanning feature is beneficial because it scans files using multiple security engines, improving detection and giving us more confidence regarding file safety.

MetaDefender has strengthened file security, which is crucial in banking. It reduces the risk of malware by ensuring every file is scanned before reaching users, giving us more confidence in file safety. Automated file inspection improves efficiency and reduces time spent on manual inspections. It has also helped reduce malware-related incidents, improving overall security and reducing operational risks.

I would appreciate more AI-driven recommendations during investigations. Suggestions for the most appropriate actions based on scanner results would help us respond quickly. Simplifying policy configuration would help us run the platform more smoothly and reduce deployment and management time.

I have been using MetaDefender for the last eighteen months.

I have been working in my current field for five years.

MetaDefender is mostly automated in the background within our workflow. We use various features such as DeepCDR and threat intelligence which help us remove potential elements such as macro scripts automatically. This automation is essential in everyday operations.

MetaDefender saves us significant time on manual inspections. Since we started using it, we no longer spend time manually checking files, reducing time by approximately seventy percent.

The user interface is complex initially, scanning large or complex files can take longer than expected, false positives occasionally require manual review, and the pricing is somewhat high. MetaDefender has strong AI capabilities combining AI with multiple advanced engines. The threat intelligence and AI file analysis are excellent, and I trust the platform because every file is inspected before reaching users. Features such as multi-scanning and DeepCDR have helped significantly in avoiding malicious files, and I trust its security framework overall. I rate MetaDefender an eight overall.

My main use case for MetaDefender is on my devices. I have a specific example of how I use MetaDefender on my devices in that it has been installed by the administrator on my VMs which are being listed on my public cloud.

I don't have anything specific to add about how I use MetaDefender in my setup, as it is protecting my whole VMs, so not any particular file.

The best features MetaDefender offers, in my opinion, are that it adapts the policies on the go, and that is the best feature.

When I say it adapts policies on the go, it has the ability that if there is a new policy or the new configuration that has come up without any downtime, it just adjusts it and reiterates to all of the users and all of the devices. MetaDefender has positively impacted my organization as it has reduced time for the users.

MetaDefender reduces time for users in their working, as it does not occupy the RAM usage of their devices plus it does not take time for the downtime or shutting down or the rebooting of the devices.

I have not seen any areas where I can suggest improvements for MetaDefender, so probably it is good enough. I would rate it an eight because its interface can be improved and it can improve their integrations as well, so there is room for improvement.

I have been working in my current field for four and a half years. I have been using MetaDefender for the past six months.

MetaDefender is stable.

MetaDefender's scalability is pretty much scalable.

The customer support is good.

I previously used a different solution, Palo Alto, which I switched from because it was very expensive.

I have seen a return on investment as fewer employees are needed in terms of implementation.

My experience with pricing, setup cost, and licensing is that it is good and at par with other competitors.

Before choosing MetaDefender, I evaluated other options, including Palo Alto and Check Point, as many were evaluated.

My impression of the detection rates provided by MetaScan Multi-scanning is that it is good and pretty accurate. I would assess the effectiveness of Deep CDR in reconstructing files safely and without signatures as they are pretty much effective, and it is really useful for the administrator.

My thoughts on the file-based vulnerability assessment feature in identifying vulnerabilities before deployment are that it is good, and it is a very good feature. I use adaptive sandbox analysis, and its impact on analyzing suspicious files is very great because it detects pretty much early.

I am using the enhanced reporting and audit visibility features, and they have helped meet our audit requirements as it has given us a great requirement study and plus it has also helped in ISO audit requirement as well. I would assess the effectiveness of the solution in blocking or sanitizing content based on policy as good and pretty much effective.

My advice to others looking into using MetaDefender is that if you are looking ahead at a solution which can be implemented quickly and at a lesser cost, go ahead with it. I would rate this product an eight overall.

The major use cases of MetaDefender in my work environment involve preventing malware updates, data breaches, and compliance violations through scanning files for malware, vulnerabilities, and sensitive data at the network perimeter.

The best features of MetaDefender include its ability to detect malware and vulnerabilities, which I also use at server levels, including production and testing servers, helping me identify and address vulnerabilities by applying patch updates.

When sanitizing files based on policies, MetaDefender processes and sanitizes files to remove hidden content, including embedded objects and scripts while preserving the visible content.

I use MetaDefender Archive Extractor, which supports over 30 archive file types, improving detection and preventing archive bombs, allowing administrators to perform archive handling once for each file type.

I would like to see improvements in the tool's automation capabilities. It would be beneficial if it could automatically create tickets and notify responsible teams about any identified vulnerabilities rather than relying on a manual process.

I want to see enhancements allowing for automatic ticket creation using APIs to streamline the workflow and assign tickets to respective teams.

I have been using MetaDefender for the last two years on my official laptop.

I do not have any stability issues with MetaDefender.

MetaDefender is scalable; it allows for automation in scaling resources as needed during peak times.

I would rate technical support as a nine out of ten.

I have evaluated other options available in the market, such as Microsoft and McAfee, but found MetaDefender to be distinct.

I decided to go with MetaDefender due to its architectural compatibility with the client's budget requirements, as its scanning and vulnerability detection capabilities are better than other tools.

For me, onboarding MetaDefender was not too difficult, being balanced between straightforward and complex.

I have seen measurable benefits, as MetaDefender saves time, preventing the need for manual processes associated with other tools.

The detection rates from MetaScan multi-scanning are managed mainly by other teams in alignment with our organization policy, where they can achieve detection rates of 81-87% with four engines or 95% with sixteen engines, and the comparison with Microsoft Defender often yields similar results.

I do not have an opinion on the effectiveness of Deep CDR in file reconstruction.

We have a process in place for identifying vulnerabilities before deployment where team members raise tickets on the ServiceNow portal for the respective teams to address.

I do not use Adaptive Sandbox analysis, as that is managed by another team.

I do not notice improvements in workflow automation as recent enhancements are managed by other teams; I am focused on using the tool to identify vulnerabilities.

I do not have an assessment of how multi-scanning and content disarm and reconstruction affect our data security operations.

I recommend implementing MetaDefender for its impressive features that maintain the health of the system. My overall review rating for MetaDefender is nine out of ten.

I am an integrator for MetaDefender. My usual use cases for MetaDefender involve connecting the products into the environment of the customer, including MetaDefender Core, ICAPs, endpoints, and all the related components.

I find the CDR, specifically the CDR ability, the most valuable aspect of MetaDefender so far. I appreciate the CDR because I can show customers how it works and demonstrate the effectiveness of this feature, and it is very helpful.

I did not pay much attention to the expanded file type and archive coverage feature initially. Could you explain what you mean by file type?

The enhanced reporting and audit visibility features are acceptable. Some customers of mine had problems with the health checks and monitoring of the logs, but it has improved, so that is very positive.

Most of the time, in our experience at Danet Communications, we work with government offices, and they need the CDR. However, because CDR is affecting files such as MSI and EXE files, they are always creating new passes of scanning. This is acceptable, but I would like OPSWAT to improve that, perhaps to decrease the impact when the process becomes slower. I am not sure if that is something that is possible.

There is something about MetaDefender that I think could be improved or enhanced, specifically regarding a feature request. Something that annoyed me was the less noticeable improvement from version 5.8.0 to 5.9.0 of MetaDefender Core. Now you have to search in the block if you want to create a blocklist, which is somewhat annoying when searching for your file. I may have just been accustomed to the old version.

From my experience, there are perhaps some improvements in workflow automation with the recent enhancements to policy orchestration and engine parallelization. However, there are many settings in the workflow that you cannot quickly understand what they are doing. Adding a question mark around them that provides a bit more information about that option would be beneficial.

I have been working with MetaDefender for approximately six to seven months.

Regarding the reliability and stability level of MetaDefender, there are minor problems here and there, but nothing specific. Every time when help is needed, we receive the assistance.

When I say there are some troubles here and there, I mean there are different and unusual bugs or complications and things that cannot be connected to each other even though all the network configuration is acceptable.

The scalability level of MetaDefender is good. It is learning and increasing with every patch, and that is acceptable.

When I need help, I reach out first by trying to find information in the documentation. If I cannot find that, I go to the Ozi AI. If I see that the AI cannot help me, then I ask for an agent.

When it comes to my communication with agents, I find they are responsive and professional. A lot of the time, they are busy, so they cannot participate in calls or Teams meetings. However, if we schedule a meeting, they will attend, especially if it is very important.

I usually participate in the initial setup, including the installation of MetaDefender. Most of the time, I send requirements for the server, and the customer has to create a server that meets what I have requested. After the customer has made the prerequisites, I can work with them on installing and connecting the products into their environment.

The initial setup usually looks like this for me: first, I need to send the prerequisites for every product, and I reference OPSWAT documentation to see what is needed, such as Visual Studio or Desknet. Then I send downloads of the products.

I usually find the initial setup has small challenges such as connectivity issues, but these are not on OPSWAT's side. They are more related to the customer's environment.

I assess the effectiveness of MetaDefender in blocking or sanitizing content based on policy as very good. It contains a lot of file types, and most of the file types are included, so that is acceptable.

My impression of the detection rate provided by MetaScan multi-scanning is positive. I work mostly with the core, and my clients have not encountered false positives or those kinds of issues.

I evaluate the effectiveness of Deep CDR in reconstructing files safely and without signatures as good. I measure if it is effective by processing a lot of files, verifying that the content I want to be removed is being removed, and confirming that the hash is different.

To be honest, the file-based vulnerability assessment feature is more of a toggle option that we always enable, but we have not thoroughly tested it. I do see the effectiveness of this feature.

I think the adaptive sandbox analysis of MetaDefender works well. We do not have many customers using it, but from the customers who are using it, it functions effectively. Some of my customers describe its impact on analyzing suspicious files as adding additional layers of security. The reviews were positive, and while it may slow the scanning time slightly, that is understandable.

I rate this review an eight out of ten overall.