Malware analysis,
without the compromise.

ThreatLab is an interactive malware analysis sandbox that runs entirely on your machine. No cloud uploads, no per-analysis fees, no session time limits. Just you, an isolated VM, and full control.

ThreatLab session window showing live malware analysis with VNC viewer and monitoring dashboard
AI threat analysis showing risk rating and behavioral findings
Process tree visualization showing execution chains
EVTX log analyzer with Sigma rule detections
PDF report page key statistics and severity distribution
PDF report page showing threats detected and IoC summary
🔒

Your Data Stays Yours

No samples uploaded to third-party clouds. No shared infrastructure. Everything runs locally on your own hardware.

♾️

No Limits, No Quotas

Run as many sessions as you want, for as long as you want. No daily upload caps, no per-analysis fees, no 5-minute session timeouts.

🎯

Analysis, Simplified

Transparent seat-based pricing that won't destroy your budget. Client-ready PDF reports. Multi-region VPN routing. Designed for your workflow.

What You Get
One platform, fully loaded.
Everything you need for malware analysis and incident investigation in a single desktop application.
🔬
Interactive Sandbox Isolated Hyper-V VMs with live desktop interaction, video recording, and full keyboard/mouse control.
📡
Deep Visibility Sysmon-powered monitoring across processes, network, files, registry, DLL injection, and credential access.
🧠
AI Threat Analysis AI-powered threat assessment with risk scoring, behavioral analysis, and MITRE ATT&CK mapping.
📋
PDF Reports Professional, client-ready analysis reports generated from your session data. Brandable with your own logo.
🌐
VPN Routing WireGuard tunnels across 4 regions with kill switch. Malware never sees your real IP.
🔎
EVTX Analyzer Built-in event log analyzer with 2,900+ Sigma rules. Timeline view, CSV/JSON export, severity filtering.
⚡
Quick Analysis Instant URL threat assessment without spinning up a VM. Fast triage for suspicious links.
📁️
Session History Full session history with recordings, screenshots, EVTX logs, reports, and all collected data preserved for every analysis. Your evidence library, always accessible.
🌳
Process Tree Visualization Interactive process chain viewer with enriched data per node. Trace parent-child relationships, injection paths, and severity scoring across the full execution tree.
🖥️
Custom Base Images Create custom VM templates with pre-installed software, EDR tools, or client-specific configurations.

Why ThreatLab over cloud sandboxes?

No per-analysis fees No file uploads to third parties No session time limits No shared infrastructure Full interactive control Unlimited sessions

Want to try ThreatLab?

Request a free trial and see what ThreatLab can do for your team. No commitment, no credit card required.

Pricing
Simple, transparent pricing.
One product, one price per seat. Volume discounts reward larger teams. No hidden fees, no per-analysis charges, no surprises.
Monthly
Annual Save 10% with annual billing
Starter
1–2 seats
$ 99 / seat / mo
All features included. Unlimited sessions. No per-analysis fees. Full VPN, AI analysis, PDF reports, EVTX analyzer, etc. See Features for a full breakdown.
Subscribe
Best Value
Team
3+ seats
$ 84 / seat / mo
15% volume discount
All features included. Unlimited sessions. No per-analysis fees. Full VPN, AI analysis, PDF reports, EVTX analyzer, etc. See Features for a full breakdown.
Subscribe
All plans include the same features. Volume discounts are applied automatically based on seat count.
Need more than 10 seats? Contact us for custom pricing.
FAQ
Common questions

What is a seat?

A seat is one machine activation. Each machine running ThreatLab requires one seat. Seats can be deactivated and moved to different machines through the management portal.

Can I change my seat count?

Yes. You can add or remove seats at any time from the Stripe billing portal. Adding seats is prorated immediately. Removing seats takes effect at the end of your billing period.

Is there a free trial?

Yes. We offer free trials on request - no credit card required. Use the form below to get started.

What are the system requirements?

Windows 10/11 Pro or Enterprise (64-bit) with Hyper-V enabled. 16 GB RAM minimum, 4+ CPU threads with virtualization support, and 50 GB free disk space.

Can I switch between monthly and annual?

Yes. You can switch billing periods at any time through the Stripe billing portal. Switching to annual applies the 10% discount immediately.

What's your refund policy?

We offer a 7-day refund window on new subscriptions. After 7 days, subscriptions are non-refundable but can be cancelled at any time - access continues until the end of the billing period.

Request a Free Trial

Interested in trying ThreatLab? Fill out the form below to get started. No credit card required.

✓

Request Received

We'll review your request and send you trial access within 24 hours. Check your email.

Features
Everything under the hood.
A detailed look at what ThreatLab brings to your security workflow.
🔬

Interactive Sandbox

Fully isolated analysis environments powered by Hyper-V

✓
Hyper-V Isolation Each session runs in a dedicated VM cloned from a clean Windows 11 base image using differencing disks.
✓
Live Desktop Interaction Full keyboard and mouse control via VNC. Interact with malware exactly as an end user would.
✓
File & URL Analysis Drop suspicious files or paste URLs. Samples are placed on the VM desktop for manual detonation.
✓
Video Recording Automatic session recording from the moment you connect. Saved as WebM files for review.
✓
Session Save & Resume Hibernate sessions and resume later. Pick up exactly where you left off.
✓
Multiple Concurrent Sessions Run several analysis sessions simultaneously, each with its own isolated VM and monitoring.
✓
Configurable Resources Adjust VM memory and CPU allocation per session based on your analysis needs.
✓
Network Isolation One-click network isolation cuts internet access while keeping your VNC connection alive.
✓
Custom Base OS Images Create modified VM templates with pre-installed software, EDR agents, or client configurations. Each session clones from your chosen image.
✓
Global Exclusions Exclude known-good processes from monitoring across all sessions.
📡

Monitoring & Detection

Deep visibility into everything that happens inside the sandbox

✓
Sysmon Event Monitoring Process creation, network connections, file system changes, registry modifications - all captured in real time.
✓
DLL Injection Detection Non-system DLL loads, remote thread creation, and process access monitoring.
✓
Credential Access Monitoring LSASS access detection distinguishes legitimate OS operations from credential theft attempts.
✓
Real-Time Threat Scoring Events scored 0–10 in real time based on behavioral indicators, process chains, and known-bad patterns.
✓
Scheduled Task & Service Monitoring Track persistence mechanisms: task creation, service installation, and startup modifications.
✓
Ransomware Canary Detection Canary files placed in the VM detect ransomware behavior through continuous integrity checks.
✓
Windows Defender Integration Choose to run sessions with Defender enabled or disabled. Defender alerts are captured when active.
✓
Privilege Switching Toggle between Local Admin and Standard User during a live session to test behavior under different privileges.
✓
Certificate Store Monitoring Detects modifications to Windows root and intermediate CA certificate stores, flagging potential MITM or rogue certificate installation.
📋

Analysis & Reporting

From raw events to client-ready deliverables

✓
AI-Powered Threat Analysis Automated threat assessment with risk scoring, behavioral analysis, key findings, and MITRE ATT&CK mapping. Can be toggled on or off in settings.
✓
PDF Report Generation Professional multi-page reports with executive summary, IOCs, severity distribution, and full technical details.
✓
Custom Report Branding Replace the ThreatLab logo with your own company branding on generated PDF reports.
✓
EVTX Log Analyzer Built-in Windows Event Log parser with timeline view, severity filtering, and event statistics.
✓
2,900+ Sigma Detection Rules Community-maintained Sigma rules bundled and applied during EVTX analysis for deep detection coverage.
✓
Quick URL Analysis Instant URL threat assessment - domain age, WHOIS data, TLD reputation - without a VM.
✓
CSV & JSON Export Export EVTX findings in CSV or JSON format for integration with other tools and workflows.
✓
EVTX File Download Download raw EVTX files from any session for analysis in external tools or evidence preservation.
✓
Process Tree Visualization Interactive process chain viewer with per-node enrichment. Network, file, registry, injection, and service activity mapped to each process with severity scoring and chain-aware filtering.
✓
Bring Your Own LLM Connect your own API key from Anthropic, OpenAI, or Google for AI analysis. Keys encrypted locally with AES-256-CBC. Custom prompt instructions per analysis type.
🌐

Network & Privacy

Anonymous analysis with complete data sovereignty

✓
Multi-Region VPN Routing WireGuard exit nodes in the US, UK, Germany, and Spain. Malware C2 never sees your real IP.
✓
VPN Kill Switch Hypervisor-level ACLs block all internet if the tunnel drops. The VM cannot bypass it.
✓
100% Local Execution No samples uploaded anywhere. All analysis happens on your hardware. Complete data privacy.
✓
Direct Mode Run sessions without VPN when anonymity isn't required or for testing internal network scenarios.
🛡️

Platform & Management

Everything that makes ThreatLab production-ready for your team

✓
Web Management Portal License management, seat allocation, machine tracking, downloads, and documentation.
✓
Built-in Issue Reporting Report issues directly from the app with optional log attachment. Detailed application logging to disk.