MetaDefender ICAP Cloud

Our main use case for MetaDefender is to inspect files, links, and other external content before we allow them into our environment. In this situation, when we receive something that looks legitimate but we don't completely trust it, such as an email attachment, customer upload, or a zip archive, we can push it to MetaDefender before we open it.

For example, if an external user sends us a document, we can submit it to MetaDefender before anyone opens it. MetaDefender has 20-plus antivirus engines which we use to get multi-detection results, instead of having to depend on a single security engine. Through MetaDefender, we normally check our file to see the reputation and other threat intelligence information to determine whether there are additional reasons to be concerned.

When the antivirus results are not clear, we use its adaptive sandbox to analyze the suspicious file in an environment where it is in the sandbox, not actually on our computers, and see how it behaves without putting an employee's computer at risk.

The best features that MetaDefender offers are predictive AI capability, which helps identify files that look risky even when the antivirus detection isn't conclusive. We use it as our additional signal.

In case we want to see summaries on what happened and why the file was detected as suspicious, MetaDefender provides that information. I personally value the Deep CDR feature greatly. When, for example, we need to work with a document but we don't want to trust all of its embedded content, or if we want to use the document but assume it may be malicious, MetaDefender can remove potentially dangerous elements and regenerate a usable version of the file, which gives us a safer way to handle that document instead of having to block everything that looks unusual.

Deep CDR is one of the best features we rely on. We received a business document that looked malicious because it contained a .exe file extension. To open it, we first ran it through MetaDefender Deep CDR. MetaDefender CDR restructured the document, removed the dangerous elements, and regenerated a usable version of the file.

Deep CDR is very useful for us when we receive a large volume of files, especially business files, and we want to open them regardless of their appearance. It can analyze the content, identify the potential risk elements, and remove them, reconstructing a clean version, so we get a sanitized file that is free from malicious content.

It is very useful for identifying security weaknesses in files that may not necessarily contain malware. The advantage of MetaDefender over other traditional antivirus solutions is that it can detect if the file is vulnerable. If it is vulnerable, we can use Deep CDR to sanitize it or discard the file. For example, my organization receives a large number of PDFs and archives from customers. MetaDefender can inspect those files, perform a vulnerability check, and help us determine whether they contain characteristics associated with known vulnerabilities.

We use adaptive sandbox, and this adaptive sandbox is very valuable because it gives MetaDefender another way to examine files that could harm our computers if we open them on actual computers. We normally push them into the adaptive sandbox, then examine them before we actually transfer them to our computers. We normally also receive PDFs and archives from customers. These regular engines may not immediately identify if the file is malicious. Instead of allowing it straight into the environment and then having the traditional antivirus detect it, MetaDefender can subject this suspicious file to deep analysis in a controlled sandbox.

Reporting has been excellent for us because in our organization we deal with facts and numbers. It helps us present, in case we reject a file, why we actually blocked this file from going to another department and what is actually happening across the whole file security environment.

More documentation is required, and more YouTube tutorials should be implemented. For example, there are some features that we paid for but we don't know how to use them. Additionally, MetaDefender should bring an option whereby large files or a high volume of uploads can be scanned very quickly because currently, large files take a lot of time to be scanned.

Regarding AI capabilities, it has predictive AI and I would be fairly positive about the security side, especially when we are dealing with it as our additional detection layer giving us summary reports about what happened to the file.

The main thing I would want improved in AI capability is explainability. If a model or antivirus flags a file as suspicious, we should be able to understand why it was flagged and what characteristics or behavior indicators contributed to the decision. I am not entirely clear about whether our data is used for model training and who can access it.

Regarding AI governance, I think MetaDefender provides value because with these AI-powered detection features enabled, it can give audit logs with AI-driven decisions and sometimes provide clear documentation about the issue or the file.

I have been using MetaDefender for two years.

MetaDefender is stable. I would rate it nine out of ten because every year we process more than five thousand files in MetaDefender, and there is not a single day when we have had downtime.

Customer support is generally adequate, especially the technical team, because it has assisted us significantly. Additionally, the AI support assistant, Ozy, helps us during our common questions and troubleshooting.

I think the return on investment comes more from avoiding security incidents and reducing the amount of manual work required from the security team. For example, if we are processing ten thousand files a month, manually investigating these files to determine if they are suspicious takes a significant amount of time to analyze them. MetaDefender can automate the initial inspection using multi-scanning, perform Deep CDR, conduct vulnerability assessment, and sandboxing, so we don't have to manually inspect the files. MetaDefender automates the inspection for us.

Pricing is generally like eight out of ten. The main issue isn't necessarily that it is expensive, but the problem is the pricing can be difficult to predict because it depends on deployment and how you actually use it based on the usage model.

We evaluated other options for MetaDefender, including options such as ReversingLabs, Spectra a-detect, and Votiro, but because of cost, malware detection assessment, and CDR and file sanitization capabilities, we chose MetaDefender.

The biggest impact we have gotten from MetaDefender is how it has given us more confidence before we allow external files into our environment. Instead of relying on one antivirus result, we can combine its features such as sandbox, Deep CDR, and multi-scanning to help us protect our systems from malicious files. Additionally, it has reduced the investigation time we spend investigating questionable files that appear malicious. Another thing is its adaptive sandbox, which has also been a positive impact on investigating safely. Instead of opening unknown files directly, we open them in a sandbox instead of having to push them on real computers.

I estimate that we have saved more than twenty hours per week on investigation time. Additionally, we have seen a drop in threats we could encounter when opening these files.

As someone who has been using MetaDefender for two years, I would recommend MetaDefender. Also, examine its CDR quality, the sandbox effectiveness, and the reporting and auditability. When starting, measure whether it is worth the money you are paying. Always pay close attention to AI governance and how data is handled. Make sure you understand where files are processed, what the retention policies are, what the access controls are, and how AI-assisted decisions are actually explained. Overall, MetaDefender is worth shortlisting in case your organization has a serious problem with file transfer security. I would rate this review nine out of ten.

MetaDefender is used to inspect every file before it enters our environment. Whenever customers upload documents through online banking, send email attachments, or when we are exchanging files, MetaDefender automatically scans those files before they are delivered to our users or into our internal systems. It uses multi-scanning to check each file with multiple antivirus engines at the same time. If a threat is detected, the file is blocked or quarantined according to our security policy.

For documents such as Word, Excel, and PDF files, we use its deep CDR, content disarm and reconstruction, to remove risky content such as macros, vendor scripts, or active projects, creating a cleaner version that employees can safely open. We also use its threat intelligence to compare files against known malware or ransomware. This is advantageous because it helps us identify malicious files quickly before they spread through our systems.

Another important use is vulnerability assessment, where the platform checks our endpoints and servers for outdated software, missing security patches, and known vulnerabilities, providing us with a report. This is beneficial in helping us reduce risks before they can be exploited.

File analysis and reporting are very important to us because they provide detailed information about each candidate file. The results include threat classification and associated recommendations. Threat intelligence helps us identify files connected to known malware and other threats, improving our detection ability. The multi-scanning feature is beneficial because it scans files using multiple security engines, improving detection and giving us more confidence regarding file safety.

MetaDefender has strengthened file security, which is crucial in banking. It reduces the risk of malware by ensuring every file is scanned before reaching users, giving us more confidence in file safety. Automated file inspection improves efficiency and reduces time spent on manual inspections. It has also helped reduce malware-related incidents, improving overall security and reducing operational risks.

I would appreciate more AI-driven recommendations during investigations. Suggestions for the most appropriate actions based on scanner results would help us respond quickly. Simplifying policy configuration would help us run the platform more smoothly and reduce deployment and management time.

I have been using MetaDefender for the last eighteen months.

I have been working in my current field for five years.

MetaDefender is mostly automated in the background within our workflow. We use various features such as DeepCDR and threat intelligence which help us remove potential elements such as macro scripts automatically. This automation is essential in everyday operations.

MetaDefender saves us significant time on manual inspections. Since we started using it, we no longer spend time manually checking files, reducing time by approximately seventy percent.

The user interface is complex initially, scanning large or complex files can take longer than expected, false positives occasionally require manual review, and the pricing is somewhat high. MetaDefender has strong AI capabilities combining AI with multiple advanced engines. The threat intelligence and AI file analysis are excellent, and I trust the platform because every file is inspected before reaching users. Features such as multi-scanning and DeepCDR have helped significantly in avoiding malicious files, and I trust its security framework overall. I rate MetaDefender an eight overall.

My main use case for MetaDefender is on my devices. I have a specific example of how I use MetaDefender on my devices in that it has been installed by the administrator on my VMs which are being listed on my public cloud.

I don't have anything specific to add about how I use MetaDefender in my setup, as it is protecting my whole VMs, so not any particular file.

The best features MetaDefender offers, in my opinion, are that it adapts the policies on the go, and that is the best feature.

When I say it adapts policies on the go, it has the ability that if there is a new policy or the new configuration that has come up without any downtime, it just adjusts it and reiterates to all of the users and all of the devices. MetaDefender has positively impacted my organization as it has reduced time for the users.

MetaDefender reduces time for users in their working, as it does not occupy the RAM usage of their devices plus it does not take time for the downtime or shutting down or the rebooting of the devices.

I have not seen any areas where I can suggest improvements for MetaDefender, so probably it is good enough. I would rate it an eight because its interface can be improved and it can improve their integrations as well, so there is room for improvement.

I have been working in my current field for four and a half years. I have been using MetaDefender for the past six months.

MetaDefender is stable.

MetaDefender's scalability is pretty much scalable.

The customer support is good.

I previously used a different solution, Palo Alto, which I switched from because it was very expensive.

I have seen a return on investment as fewer employees are needed in terms of implementation.

My experience with pricing, setup cost, and licensing is that it is good and at par with other competitors.

Before choosing MetaDefender, I evaluated other options, including Palo Alto and Check Point, as many were evaluated.

My impression of the detection rates provided by MetaScan Multi-scanning is that it is good and pretty accurate. I would assess the effectiveness of Deep CDR in reconstructing files safely and without signatures as they are pretty much effective, and it is really useful for the administrator.

My thoughts on the file-based vulnerability assessment feature in identifying vulnerabilities before deployment are that it is good, and it is a very good feature. I use adaptive sandbox analysis, and its impact on analyzing suspicious files is very great because it detects pretty much early.

I am using the enhanced reporting and audit visibility features, and they have helped meet our audit requirements as it has given us a great requirement study and plus it has also helped in ISO audit requirement as well. I would assess the effectiveness of the solution in blocking or sanitizing content based on policy as good and pretty much effective.

My advice to others looking into using MetaDefender is that if you are looking ahead at a solution which can be implemented quickly and at a lesser cost, go ahead with it. I would rate this product an eight overall.

The major use cases of MetaDefender in my work environment involve preventing malware updates, data breaches, and compliance violations through scanning files for malware, vulnerabilities, and sensitive data at the network perimeter.

The best features of MetaDefender include its ability to detect malware and vulnerabilities, which I also use at server levels, including production and testing servers, helping me identify and address vulnerabilities by applying patch updates.

When sanitizing files based on policies, MetaDefender processes and sanitizes files to remove hidden content, including embedded objects and scripts while preserving the visible content.

I use MetaDefender Archive Extractor, which supports over 30 archive file types, improving detection and preventing archive bombs, allowing administrators to perform archive handling once for each file type.

I would like to see improvements in the tool's automation capabilities. It would be beneficial if it could automatically create tickets and notify responsible teams about any identified vulnerabilities rather than relying on a manual process.

I want to see enhancements allowing for automatic ticket creation using APIs to streamline the workflow and assign tickets to respective teams.

I have been using MetaDefender for the last two years on my official laptop.

I do not have any stability issues with MetaDefender.

MetaDefender is scalable; it allows for automation in scaling resources as needed during peak times.

I would rate technical support as a nine out of ten.

I have evaluated other options available in the market, such as Microsoft and McAfee, but found MetaDefender to be distinct.

I decided to go with MetaDefender due to its architectural compatibility with the client's budget requirements, as its scanning and vulnerability detection capabilities are better than other tools.

For me, onboarding MetaDefender was not too difficult, being balanced between straightforward and complex.

I have seen measurable benefits, as MetaDefender saves time, preventing the need for manual processes associated with other tools.

The detection rates from MetaScan multi-scanning are managed mainly by other teams in alignment with our organization policy, where they can achieve detection rates of 81-87% with four engines or 95% with sixteen engines, and the comparison with Microsoft Defender often yields similar results.

I do not have an opinion on the effectiveness of Deep CDR in file reconstruction.

We have a process in place for identifying vulnerabilities before deployment where team members raise tickets on the ServiceNow portal for the respective teams to address.

I do not use Adaptive Sandbox analysis, as that is managed by another team.

I do not notice improvements in workflow automation as recent enhancements are managed by other teams; I am focused on using the tool to identify vulnerabilities.

I do not have an assessment of how multi-scanning and content disarm and reconstruction affect our data security operations.

I recommend implementing MetaDefender for its impressive features that maintain the health of the system. My overall review rating for MetaDefender is nine out of ten.

I am an integrator for MetaDefender. My usual use cases for MetaDefender involve connecting the products into the environment of the customer, including MetaDefender Core, ICAPs, endpoints, and all the related components.

I find the CDR, specifically the CDR ability, the most valuable aspect of MetaDefender so far. I appreciate the CDR because I can show customers how it works and demonstrate the effectiveness of this feature, and it is very helpful.

I did not pay much attention to the expanded file type and archive coverage feature initially. Could you explain what you mean by file type?

The enhanced reporting and audit visibility features are acceptable. Some customers of mine had problems with the health checks and monitoring of the logs, but it has improved, so that is very positive.

Most of the time, in our experience at Danet Communications, we work with government offices, and they need the CDR. However, because CDR is affecting files such as MSI and EXE files, they are always creating new passes of scanning. This is acceptable, but I would like OPSWAT to improve that, perhaps to decrease the impact when the process becomes slower. I am not sure if that is something that is possible.

There is something about MetaDefender that I think could be improved or enhanced, specifically regarding a feature request. Something that annoyed me was the less noticeable improvement from version 5.8.0 to 5.9.0 of MetaDefender Core. Now you have to search in the block if you want to create a blocklist, which is somewhat annoying when searching for your file. I may have just been accustomed to the old version.

From my experience, there are perhaps some improvements in workflow automation with the recent enhancements to policy orchestration and engine parallelization. However, there are many settings in the workflow that you cannot quickly understand what they are doing. Adding a question mark around them that provides a bit more information about that option would be beneficial.

I have been working with MetaDefender for approximately six to seven months.

Regarding the reliability and stability level of MetaDefender, there are minor problems here and there, but nothing specific. Every time when help is needed, we receive the assistance.

When I say there are some troubles here and there, I mean there are different and unusual bugs or complications and things that cannot be connected to each other even though all the network configuration is acceptable.

The scalability level of MetaDefender is good. It is learning and increasing with every patch, and that is acceptable.

When I need help, I reach out first by trying to find information in the documentation. If I cannot find that, I go to the Ozi AI. If I see that the AI cannot help me, then I ask for an agent.

When it comes to my communication with agents, I find they are responsive and professional. A lot of the time, they are busy, so they cannot participate in calls or Teams meetings. However, if we schedule a meeting, they will attend, especially if it is very important.

I usually participate in the initial setup, including the installation of MetaDefender. Most of the time, I send requirements for the server, and the customer has to create a server that meets what I have requested. After the customer has made the prerequisites, I can work with them on installing and connecting the products into their environment.

The initial setup usually looks like this for me: first, I need to send the prerequisites for every product, and I reference OPSWAT documentation to see what is needed, such as Visual Studio or Desknet. Then I send downloads of the products.

I usually find the initial setup has small challenges such as connectivity issues, but these are not on OPSWAT's side. They are more related to the customer's environment.

I assess the effectiveness of MetaDefender in blocking or sanitizing content based on policy as very good. It contains a lot of file types, and most of the file types are included, so that is acceptable.

My impression of the detection rate provided by MetaScan multi-scanning is positive. I work mostly with the core, and my clients have not encountered false positives or those kinds of issues.

I evaluate the effectiveness of Deep CDR in reconstructing files safely and without signatures as good. I measure if it is effective by processing a lot of files, verifying that the content I want to be removed is being removed, and confirming that the hash is different.

To be honest, the file-based vulnerability assessment feature is more of a toggle option that we always enable, but we have not thoroughly tested it. I do see the effectiveness of this feature.

I think the adaptive sandbox analysis of MetaDefender works well. We do not have many customers using it, but from the customers who are using it, it functions effectively. Some of my customers describe its impact on analyzing suspicious files as adding additional layers of security. The reviews were positive, and while it may slow the scanning time slightly, that is understandable.

I rate this review an eight out of ten overall.