ANY.RUN

Plans and prices

Every plan, in full

On the record

Analysis

Users can upload a file or submit a link to inspect sample behavior, indicators of compromise, tactics, techniques, and triggered detection rules.any.run · read 29 Sep 2026

Analysis speed

ANY.RUN says its virtual machines start in under 10 seconds and reports are ready in 40 seconds.any.run · read 29 Sep 2026

API and formats

ANY.RUN offers access through API and SDK and lists STIX/MISP support for integrations.any.run · read 29 Sep 2026

Behavior visibility

The product presents process trees, network activity, file activity, registry changes, screenshots, and extracted indicators.gartner.com · read 14 Oct 2026

Chrome extension

The Chrome extension submits files and URLs to the sandbox or Safebrowsing and can produce JSON, MISP, and HTML reports.chromewebstore.google.com · read 14 Oct 2026

Company founded

ANY.RUN’s company history dates the founding idea to 2016 and names Aleksey Lapshin as founder.any.run · read 14 Oct 2026

Company headquarters

The official site identifies ANYRUN-FZCO at Dubai Silicon Oasis, Dubai, United Arab Emirates.any.run · read 14 Oct 2026

Company history

ANY.RUN's about page says the idea for the product dates to 2016 and names Aleksey Lapshin as its founder.any.run · read 29 Sep 2026

Company scale

ANY.RUN says it serves organizations in 195 countries and has more than 150 professionals.any.run · read 14 Oct 2026

Company size

LinkedIn lists ANY.RUN as a privately held computer and network security company with 51–200 employees and headquarters in Dubai Silicon Oasis.linkedin.com · read 14 Oct 2026

Data formats

Integrations support STIX/TAXII and API/SDK delivery of structured threat data.any.run · read 14 Oct 2026

Integrations

Connectors are offered for Microsoft Defender, Microsoft Sentinel, OpenCTI, SentinelOne, Splunk SOAR, Splunk Enterprise, Cortex XSOAR, Elastic Security, FortiSIEM, FortiSOAR, Google SecOps, and IBM QRadar SOAR.any.run · read 14 Oct 2026

Intended users

The Enterprise Suite is presented for SMBs, enterprise companies, MSSPs, and government agencies.any.run · read 29 Sep 2026

Interactive analysis

Users can control a virtual machine in the browser, click files, open archives, and browse websites during detonation.any.run · read 14 Oct 2026

Interactive sandbox

The sandbox runs in a browser and lets analysts interact with a virtual machine in real time.any.run · read 29 Sep 2026

Limit: access complaints

Trustpilot reviewers complain about business-email requirements and difficulty obtaining access for personal or hobby use.uk.trustpilot.com · read 14 Oct 2026

Limit: Gartner reviewers

Gartner’s displayed dislikes identify heavy free-tier restrictions and limited operating-system support.gartner.com · read 14 Oct 2026

Limit: interface and environments

G2 reviewers mention crowded displays on long analyses, slow startup or high resource use, sandbox-aware malware, and a desire for more OS/browser versions.g2.com · read 14 Oct 2026

Alternatives to ANY.RUN

M MalwagonWebWindows+3 CF CrowdStrike Falcon ProAndroidiPhone & iPad+5 CS CAPE SandboxWebWindows+3 D DetonateWebLinux+2 R RetraceAndroidWeb+5 HT Hatching TriageAndroidWeb+5 HA Hybrid AnalysisWebAPI RC ReversingLabs Cloud SandboxAndroidWeb+4

Every alternative, ranked