MetaDefender Core Windows - Advanced Threat Protection (BYOL AMI)

Before accessing the company's protected resources, it is being scanned through MetaDefender Endpoint, which scans the local operating system and machine before the request actually hits the company's protected resources.

MetaDefender Endpoint has been installed in the Windows operating system machine, and before accessing any protected resource of the company, MetaDefender scans the request and the resources, and it even scans the local machine. If there is any vulnerability or any kind of malware, then it immediately blocks the resource and does not allow access to the protected resource for the company. In this case, it is the company's protected resource, so access is not allowed. It checks the software and checks the various software that is installed in the machine, and if all are acceptable, then only MetaDefender is allowed to access the protected resources.

For companies that are widely distributed and have resources with company employees widely located across the world, it provides a centralized, secure platform before accessing any protected resource. This is a mandatory software that everyone should install in their machine and ensure that it passes all the quality checks, making it a strong platform in terms of security and securing protected resources.

MetaDefender is fundamentally a security platform. All resources that are company proprietary resources are secured with MetaDefender Endpoint, and this is what was desired at the company level. It is mandatory for each and every resource in the company located across the globe to be scanned by MetaDefender Endpoint before accessing these protected resources.

All employees in the organization are keeping their machines up to date; all software is regularly upgraded. For example, browser versions or other software such as Notepad++ are being upgraded. They are also conducting full Windows scans, meaning they are doing complete security full scans on their machines on a monthly basis because this is set at the organization security policy where it is mandatory to scan the machine once a month. These security policies are implemented, and MetaDefender is valuing these policies and ensuring that all employees are aligning with the security policy.

MetaDefender checks all the software and its latest version, and whether the local software that is installed is aligned with the organization policy that is set by the organization security administrator. MetaDefender passes all this information and checks against those policies that are being set and determines whether the installed software is aligned with the organization policy or not. For example, if any deprecated software or any software that has any kind of malware is in the machine, then it immediately highlights and stops accessing those protected resources.

MetaDefender is always on at startup; it must be enabled during startup of the operating system, and when accessing any protected resource, after authorization and authentication, it immediately checks whether the resource being accessed is allowed for access, and it scans all the software. Whether it is a browser version such as Chrome browser, or if it is having a deprecated or older version, or any operating system software such as WinRAR or Notepad++, any software that is deprecated or has an older version, it will immediately flag that as an error and will not allow access to the protected resources.

This is quite helpful in terms of securing resources; it immediately brings those vulnerabilities or incompatibilities in the system to attention. It also provides the feature to check the status of the operating system or machine status immediately. There is an icon at the taskbar; clicking and rechecking the status of MetaDefender Endpoint shows the current status. If all are acceptable, then it will confirm that all is well, and access to the protected resources can proceed. If there is any issue, it will flag that on the screen when rechecking the status.

MetaDefender highlights all the vulnerabilities the moment of accessing the protected resources, so it scans all the files in the system and brings those issues when clicking the recheck button.

It does the auditing of the local machine and maintains awareness of what is occurring on the machine, specifically from the security perspective. If there is any vulnerability or any kind of malware being deployed in the machine, it immediately stops access to those protected resources.

If there is any major vulnerability, then it is understood that it should not allow access to the protected resource. However, if the vulnerabilities are not serious and are at the information or warning level, then MetaDefender should allow access to those protected resources. For example, if using an older Chrome browser version, it should not be a significant security issue. Similarly, older version Notepad++ represents low priority issues that MetaDefender could still allow employees to access the protected resources, but currently, MetaDefender treats these small issues as high priority.

MetaDefender will not automatically open the screen and display vulnerabilities unless the recheck button is clicked, which is something that could be improved. The moment the operating system or machine is opened, it should highlight any issues if there are vulnerabilities rather than waiting for the recheck button to be clicked.

The recheck button needs to be clicked every time. Additionally, low priority issues are taken very seriously and considered blockers. For example, outdated browser versions or any software in the machine that does not have the latest version could be considered low priority if the software is not critical.

The full scan takes considerable time; a complete Windows full scan takes almost 12 hours because it has billions of files. The full scan is time-consuming, and if MetaDefender could scan it more quickly and provide results faster, that would be an improvement.

Regarding improvements, low priority software that is highlighted as a blocker could be reworked to still allow the user to access the protected resources. Additionally, MetaDefender could introduce some kind of workflow or user interface which highlights all issues or vulnerabilities in one place rather than requiring clicking the recheck button and navigating through the browser.

This product has been in use for two years.

MetaDefender is stable, but it brings or highlights items which are low priority, and software upgrades need to occur very frequently because it checks all the minute details in the operating system and system and brings them forward, necessitating software upgrades.

MetaDefender handles the scale well. There are quite a lot of employees, more than 50,000 employees, and all are using it, making it a quite scalable platform.

Customer service has not been contacted yet because it is a quite stable environment and a stable platform. MetaDefender highlights all the issues and even guides how to resolve vulnerabilities, for example, by installing upgraded software or conducting a full scan. It is quite comprehensive in explaining the issues that are currently encountered.

MetaDefender Endpoint has provided benefit from its use. The company's resources are fully protected and secured; no unauthorized access can reach the protected resources. All resources are now secured, and MetaDefender Endpoint can be trusted in this area.

The setup and pricing are managed at the organization level, and the security department or the infrastructure department would have better knowledge of costing and pricing.

Previously, the authentication and authorization method was using Azure Active Directory, or Azure Entra ID, and now MetaDefender is also used along with Azure AD.

From the security perspective, I would rate it an eight. MetaDefender is on-premises and managed by the company's platform. For any company where resources are widely located across the globe, MetaDefender Endpoint should be considered as one of the security platforms that ensure all protected resources are very much secure.

My main use case for MetaDefender is for security purposes, as we are a cybersecurity team, and currently we are using it for purposes such as antivirus scanning and other security measures.

In my day-to-day work, we are working with a company called Opswat, and we have devices, so to keep everything clean and clear, we are using MetaDefender as an antivirus firewall. We are inserting this MetaDefender chip for scanning purposes and using it as a firewall as well, but I do not have much knowledge about it because I am in a non-technical role right now.

In terms of using MetaDefender, we are utilizing it for threat detection, multi-scanning, and enterprise security.

MetaDefender has impacted my organization positively by adding an extra layer of security to our file and content handling process, and through its CDR, it ensures that files are sanitized before they reach our environment, which has improved our security posture.

I have noticed that the confidence and security of file processing have improved, with multi-engine scanning providing threat detection, and the security checks help us identify malicious files before they enter our environment, although I have not yet observed a specific, quantified business impact.

In my experience, MetaDefender offers a Deep CDR, and other major strengths include multi-scanning, Tri-tech AI, Adaptive Sandbox, Proactive DLP, and file vulnerability assessment.

Out of those features, I find myself relying on Deep CDR the most because it is one of MetaDefender's key differentiators; it does not depend only on detecting known malware but sanitizes and reconstructs files to prevent potentially malicious content, including zero-day threats, from reaching the environment.

Regarding MetaDefender's AI features, I think it handles data responsibly and keeps things secure by providing protection in multiple layers through malware scanning, threat detection, and content sanitization, which helps organizations manage security risks while maintaining a good balance between security, control, and compliance.

I find MetaDefender's AI capabilities to be reliable and useful as an additional layer of threat detection, with results that have been generally consistent and provide useful insights when analyzing files, though I have not used the AI capabilities long enough to independently measure accuracy.

My impression of the detection rates from MetaDefender's Metascan Multi-scanning has been positive; using multiple scanning engines provides broader coverage and greater confidence that potential threats will not be missed, and while I have not independently measured the detection rate, the results I have seen are consistent and useful for identifying potential malicious files.

I assess Deep CDR as highly effective in reconstructing files safely and without signatures because it focuses on safely reconstructing files rather than relying only on traditional malware signatures, which is particularly valuable for handling unknown or potentially zero-day threats while keeping reconstructed files usable.

I think the file-based vulnerability assessment feature is valuable because it helps identify potential vulnerabilities before files or applications are deployed, providing an additional preventive security layer that helps organizations address risk earlier rather than discovering them post-deployment.

We are using the reporting and audit visibility features to gain better visibility into scanning activities and results, which help provide a clearer record of what has been scanned and the outcomes, aiding in tracking and audit purposes from an operational perspective.

One area where MetaDefender could improve is by making the user experience more intuitive, especially for new users, with clear guidance, simpler navigation, and a more detailed explanation of scan results and outcomes, which would enhance the effectiveness for users, while better onboarding and learning resources would help users get familiar with the different features more quickly.

The usability and onboarding are my main concerns, as I do not have much overview on the technical aspects.

I have been using MetaDefender for two to three months.

MetaDefender offers strong security capabilities and multiple layers of threat detection, but since I am still relatively new to this platform, I would explore more of its features before giving it a higher rating. Even though MetaDefender provides a strong, multilayered security and is quite useful and comprehensive, the user experience on onboarding and the clarity of scan results could be simpler, especially for new users.

My advice to organizations looking into using MetaDefender is to seek an additional layer of security around file and content handling, as it is a great choice with multi-engine scanning, CDR, and vulnerability assessment capabilities providing good overall coverage. It is important to clearly understand your organization's security requirements and take time to explore the different features and integrations to get the most value from the platform.

I would rate MetaDefender as an eight out of ten.

My main use case for MetaDefender is for multi-scanning purposes, including Deep CDR, sandbox-based analysis, and protecting the organization from malware and other file-based threats delivered through email, particularly suspicious or unknown attachments. I primarily view it as an additional inspection layer for email attachments, using its multi-scanning capability to analyze files with multiple detection engines. The Deep Content Disarm and Destruction capability is also valuable because it can remove potentially malicious content from supported files and provide a safer version for the user. From a SOC's perspective, this is particularly useful for handling files that may bypass traditional signature-based security controls while email filtering is happening. It gives us additional confidence when dealing with documents such as PDFs and Office files and all other materials that we receive through email. MetaDefender prevents malicious or weaponized files from reaching users while reducing the risk associated with unknown, zero-day file-based threats.

The best features of MetaDefender include multi-scanning, multi-layered scanning of any email or attachment, the CDR feature, and the sandboxing analysis capability. The multi-scanning feature is particularly useful because a file can be checked against multiple antivirus engines instead of relying on a single detection engine. Deep CDR is one of the strongest features because instead of only detecting whether the file is malicious, it can sanitize supported files by removing potentially dangerous content and reconstructing a safe version. This is especially useful for documents and email attachments where we still need to allow the business to work with the file. The adaptive sandbox is another valuable feature for files that require deeper behavior analysis, providing another layer for identifying suspicious or malware-like content that may not be obvious through the traditional scanners that we use.

MetaDefender has a positive impact by adding multiple layers of file scanning, email classification, and attachment investigation in a more efficient way. Instead of just relying on the verdict from our primary email or endpoint security solution, we can use MetaDefender to get additional analysis across multiple engines. This is especially helpful when dealing with suspicious or previously unseen files, zero-day attack files. Deep CDR has also been useful from a risk reduction perspective because potentially dangerous content can be removed from supported files while still allowing users to work with a usable version of the document. Overall, MetaDefender has a positive impact on analysis and detecting suspicious files, leading to greater confidence in our environment. It has also helped reduce some of the manual efforts involved in determining whether the attachment is safe or not.

MetaDefender is quite better in all aspects it has been designed for. We could enhance the user interface and user experience, as the platform has many security capabilities, but some configuration and policy management tasks can take time to understand, especially for someone using the product for the first time. I would appreciate more intuitive reporting and dashboards. The security information is useful, but making key metrics, detection trends, false positives, and remediation actions easier to understand would help a SOC team quickly identify areas requiring attention. Another area for improvement would be reducing false positives and improving processing time for large or complex files, which sometimes may require additional manual review. The CDR is a very useful tool, but clearer handling and exception management should be implemented when sanitizing legitimate files. Automation and integrations could also be enhanced, particularly around recommending appropriate actions based on scan results and simplifying integration with other security tools.

We have been using MetaDefender for more than two years.

From my overall experience, MetaDefender is a very stable and reliable product when it comes to the outcomes of file analysis and email attachments received. In my day-to-day experience, I have not encountered any major stability issues that would significantly affect email or file security operations. The core functions, such as multi-scanning, sandboxing, and file inspection, have been consistent. Once the policies and integrations are configured properly, there is minimal ongoing maintenance required to keep the solution operational. I would monitor its performance when handling very large or complex files, as scanning can sometimes take longer.

MetaDefender can handle any traffic and is suitable for any organization regardless of size. With our security requirements, we can achieve this with the existing environment and scale without requiring redesign or re-architecture. Its main advantage is the flexibility in deployment, allowing it to be deployed in the cloud or on-premises. Additional instances can be added as email volume and the number of protected users increases. Overall, I consider MetaDefender to be highly scalable and suitable for any growing organization of any size, with the main requirements being proper planning for traffic and security workloads.

Their customer support is outstanding. Whenever we raise any support case, they provide complete structural descriptions and solutions to the problems we report, and they resolve issues on the spot. I would rate them nine out of ten.

We were previously using Evinent as a security tool, and we incorporated MetaDefender for extensive EDR plus email security.

The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.

We are a customer.

We have reduced some of our manual effort and saved time, even investing additional time on zero-day attacks. In file analysis, we have sometimes saved a lot of time, while also spending a little more on suspicious files. Overall, using MetaDefender has been beneficial and can be justified as a positive investment.

The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.

If you are looking for a solution that enhances your email security or your EDR product, and if you are considering more security solutions that can protect both combinedly, I would recommend MetaDefender as one of the best tools. Its features include multi-scanning, Deep CDR, sandboxing, and file investigation, which are essential for effective detection while minimizing false positives and scanning times. Integration with the existing environment is also important; if you are using Microsoft 365, ensure that flow connectors and policies are planned and tested before moving into production. I would also check for potential conflicts or mail loops if another third-party email security solution is already deployed. Another recommendation is to spend time on policy tuning and user group segmentation. MetaDefender allows policies to be prioritized and applied to specific audiences, making administration much easier as the environment grows. I would recommend this approach as well. My overall rating for MetaDefender is eight out of ten.

My main use case for MetaDefender involves the Central Management Console, core service, and ICAP service.

In my day-to-day work, I use MetaDefender to scan endpoint security, but we did not have a product to cover API traffic scans. MetaDefender OPSWAT provides that solution, and also the ICAP scans. It is a really good product. We have customers sending all the files via API calls, and they will be scanned by OPSWAT for antivirus scan and also Data Loss Prevention scan. It is a great product.

We have more than ten different vendors connected to MetaDefender for scanning, and it is working very well.

The best features MetaDefender offers are the ICAP Scan and API Scan. For the ICAP Scan and API Scan, they stand out to me because they are easy to manage and can also adopt multi-clients at the same time and scan by seven different scan engines and different antivirus signatures scan.

MetaDefender positively impacts my organization by filling the gap, as we do not have any other product that can scan API calls. It has helped to improve compliance requests. It also scans all the API traffic and makes sure the API traffic is secured and clean.

MetaDefender can be improved by upgrading the Linux version, which is using many free tools such as MongoDB, Postgres, and OpenSSL. It can be easily targeted by hackers. If MetaDefender can upgrade those free versions of products regularly to cover those vulnerabilities, that would be beneficial. Regular patching, upgrades, and CVE coverage would be beneficial, especially because AI attacks can exploit any vulnerabilities, CVEs, and zero-days from those free MongoDB tools, which are an easy target.

Regarding MetaDefender's AI capabilities, I do not see much AI integration with MetaDefender at this moment. My thoughts on its accuracy and reliability of output are that it relies on signature-based antivirus scan, which is not sufficient for AI-kind vulnerabilities or hacking. This part needs improvement.

I have been using MetaDefender for five years.

MetaDefender is a stable product.

MetaDefender's scalability is great. We can increase the central management server by adding more CPU, RAM, and disks, and we can add more clients to the scan and create a policy for them. It has great scan capability and great extendibility.

Customer support is great. I have worked with the Vietnam team quite a few times, and they are always very active, proactive, and offer remote sessions quite a few times. It is a great service.

Previously, we were using McAfee antivirus scan servers for ICAP filters, but with increasing API call requests, MetaDefender filled that gap and provided the API call scan service, which is great.

We tried Deep CDR for a while, but it was consuming a lot of CPU and RAM, so we stopped that.

With the recent enhancements to policy orchestration and engine parallelization, we upload all MetaDefender detection events into Splunk, and our incident response team is using the Splunk SOAR product to automate all those detections and reactions. It is a Splunk integration. I assess the effectiveness of the solution in blocking or sanitizing content based on policy by noting that we are using Splunk, and the CISO and the incident response team are using the Splunk SOAR console to perform automation detections and reactions.

I see a return on investment.

My experience with pricing, setup cost, and licensing is that the cost and license fee is increasing every year.

Before choosing MetaDefender, we did not evaluate other options. We mainly wanted to use OPSWAT for API call scans, and we could not find any other product in the market at that time.

My advice to others looking into using MetaDefender is that it is a great product. We are only using the on-premise product because of company policy, as we are not allowed to upload our customer data into the public cloud. I think the hybrid cloud and private cloud product would be beneficial. That is the trend, so using hybrid cloud mode is a beneficial option for all other companies. We are currently still using the on-premise product.

We are not using the enhanced reporting and audit visibility features at this time.

The file-based vulnerability assessment feature is great because it can scan using seven different antivirus scan engines, but with AI attacks now, signature-based detection is not sufficient, which is a problem for all antivirus product vendors.

I give MetaDefender an overall rating of ten out of ten.