Sold by
MetaDefender Core Windows - Advanced Threat Protection (BYOL AMI)
MetaDefender Core detects over 99% of known and unknown malware and recursively sanitizes 200+ file types, helping organizations secure every file across security workflows and enforce zero trust at the file level.
Ratings and reviews
4.3
24 ratings
5 AWS reviews
|
19 external reviews
External reviews are from PeerSpot .
Reviews (24)
Manoday Ahire
Multi-engine security scanning has strengthened our AWS deployments and streamlines threat checks
Reviewed on Nov 05, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for MetaDefender is to scan files, URLs, and software for malware and security threats before using or deploying them. Almost two months ago, before deploying a Docker image to AWS ECS, I used MetaDefender to scan the software package for malware and suspicious files to ensure it was safe to deploy.
I also use MetaDefender to scan downloaded dependencies, deployment packages, and third-party software for malware or suspicious files before integrating them into our AWS infrastructure. We primarily use MetaDefender as a part of our security software and pre-deployment validation process, helping us scan files, application packages, and third-party dependencies before they are introduced into our AWS environments. Our deployment workflow is managed through Jenkins CI/CD, where security checks help reduce the risk of deploying malicious or compromised files.
How has it helped my organization?
MetaDefender has positively impacted our organization by improving our deployment security and adding an extra layer of protection before software reaches production. Multi-engine scanning helps us identify potentially malicious files early, reduce security risks, and deploy with greater confidence. It also saves time by making security checks easier and more consistent.
We use multi-engine scanning to check deployment packages and third-party files before integrating them into our AWS ECS environments, helping us catch suspicious files early and avoid introducing unverified software into production. While I don't have exact figures, MetaDefender has strengthened our pre-deployment security checks and improved our confidence in releases.
The integration of multi-scanning with content disarm and reconstruction (CDR) strengthens our overall data security. Multi-scanning helps detect known and suspicious threats using multiple security engines, while CDR removes potentially harmful content from files while keeping them usable. Together, they reduce the risk of malicious files entering our AWS environments and make our pre-deployment security process reliable.
The recent enhancements to policy orchestration and engine parallelization have made the scanning workflow more efficient. Policy orchestration helps apply security rules consistently, while engine parallelization reduces waiting time by running multiple scanning engines simultaneously, which leads to faster results, less manual intervention, and smoother security checks before deployment.
What is most valuable?
The best features MetaDefender offers include scanning for malware and a multi-engine malware scanning capability that checks files using multiple antivirus engines, making it easier to identify suspicious files, malicious code, and potential threats before deploying applications to production.
One feature I rely on the most is multi-engine scanning because it helps me verify files, application packages, and third-party dependencies using multiple security engines before deployment. I find it especially useful for reducing the risk of introducing malware into our AWS production environments.
The AI capabilities are useful for identifying suspicious files and potential security threats. Its multi-engine approach provides additional confidence by comparing results from different security engines. However, I would not rely on it blindly and will still validate critical findings through additional security checks before approving production deployments.
We use expanded file type and archive coverage scanning where applicable, which is helpful because application deployment packages often contain multiple files, dependencies, and nested archives. Scanning these contents provides better visibility into potential threats and reduces the chance of malicious files going unnoticed, adding an extra layer of confidence to our pre-deployment security process.
We use enhanced reporting and audit visibility to review scan results, track detected threats, and maintain better visibility into our security checks. It helps us understand why a file was flagged, investigate suspicious activity, and maintain a record for further security reviews.
My impression of MetaDefender's multi-scanning detection rates is positive. Since it uses multiple antivirus engines, it provides broader threat coverage than relying on a single engine, and I find the combined results useful for identifying suspicious files and reducing the chances of missing potential threats. I also consider false positives and validate critical findings before taking action.
I assess Deep CDR positively because it helps reconstruct files by removing potentially malicious content while preserving their usability, which is particularly useful when handling external documents and files from untrusted sources. It adds another layer of protection by reducing dependence on traditional signature-based detection, though reconstructed files should still undergo security validation before use.
MetaDefender is useful for enforcing security policies by identifying malicious files and helping block or sanitize potentially unsafe content before it enters our environment. I particularly value the ability to apply security rules consistently, which helps reduce manual security checks and ensures that files meet our security requirements before being used in production.
The file-based vulnerability assessment feature is very useful because it helps identify security risks in files and software packages before deployment, allowing us to catch vulnerable components, outdated dependencies, and potential security issues early in the CI/CD pipeline rather than discovering them in production. For DevOps teams, this supports proactive security and safer releases.
We use adaptive sandbox analysis when deeper analysis of suspicious files is needed. It is useful because it examines file behavior in an isolated environment, allowing us to identify potentially malicious activity that traditional scanning might miss instead of relying only on static signatures.
What needs improvement?
MetaDefender already provides many useful capabilities. However, I think it could be improved with better integration into CI/CD pipelines such as Jenkins and GitHub Actions, automated scanning, faster scan results, clearer vulnerability reports, and real-time alerts would make it easier for DevOps teams to identify threats and block unsafe files before production deployment.
Better automation, detailed reporting, and smoother DevOps integration would make MetaDefender even more useful for teams managing cloud infrastructure and frequent deployments.
Regarding MetaDefender's AI capabilities, I think they are valuable, especially when it comes to identifying suspicious files and potential security threats. Governance and data protection are equally important, and I would like to see strong data privacy controls, transparent AI decision making, clear audit logs, and strict access management to ensure sensitive files and information remain protected.
For how long have I used the solution?
I have been using MetaDefender for approximately one to one and a half years.
What do I think about the stability of the solution?
MetaDefender has shown reliability in my experience with no downtime or reliability issues. I find MetaDefender to be stable with no downtime or reliability concerns.
What do I think about the scalability of the solution?
MetaDefender offers better scalability as it is a SaaS solution.
How are customer service and support?
I do not have any experience with the support team, but I think that having customer support would be beneficial.
Which solution did I use previously and why did I switch?
We were using a different type of solution for file checking, such as Trivy and traditional antivirus tools, as well as manual security checks. We started using MetaDefender because its multi-engine scanning provides broader threat detection, better visibility, and an additional layer of security, fitting better with our needs to validate files and software before deployment.
What was our ROI?
Regarding return on investment, we have seen value mainly in time saving and improved security efficiency. Automated scanning reduces the need for repetitive manual file checks and helps identify suspicious files earlier in the deployment process, also reducing the effort required for initial security investigations. While I don't have verified financial figures, the biggest benefit has been faster security validation, fewer manual checks, and greater confidence in production deployments.
What's my experience with pricing, setup cost, and licensing?
In terms of pricing, I find nothing significant. Overall, my experience with MetaDefender's setup and licensing has been positive. The initial setup required some configurations and understanding of the security policies, but the process is manageable. Pricing is reasonable considering the security capabilities it offers, though I would appreciate more flexible licensing options and transparent pricing as usage and scanning requirements grow.
Which other solutions did I evaluate?
Before using MetaDefender, we evaluated options such as traditional antivirus solutions while looking for a solution that offers multi-engine scanning, file sanitization, and better integration with our security workflow.
What other advice do I have?
I rate MetaDefender nine out of ten because it provides reliable multi-engine scanning, helps detect potential threats early, and adds an extra layer of security to our deployment process. It is easy to use and gives me more confidence when handling files and software. I am keeping one point aside for improvements in CI/CD automation, integration, and reporting.
MetaDefender is one of the best tools I recommend for production environments if you want to scan any vulnerabilities in files or URLs. Before using it, ensure you have a proof of concept of this tool and ensure you have trained personnel before integrating it into your production or test environments, so you can test how it will impact your organization. Overall, I recommend using MetaDefender.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
reviewer2915043
Layered file scanning has strengthened threat detection and reduced manual verification work
Reviewed on Nov 04, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for MetaDefender is scanning and sanitizing files before they enter our internal environment, where we mainly focus on identifying malicious files and preventing potential threats from spreading through the network.
MetaDefender fits into our broader security strategy as a pre-ingest control, preventing malicious content from entering our system before it can trigger alerts elsewhere.
How has it helped my organization?
Overall, the process with MetaDefender has been quite effective for my team, giving us an extra layer of security, especially when receiving files from outside sources, resulting in better visibility, reduced risk, and more confidence when allowing legitimate file transfers.
The positive impact of MetaDefender includes improving file security and reducing manual checks, as the multiple scanning engines and CDR help catch suspicious files and strip harmful content.
MetaDefender saves time by reducing how much manual file verification my team needs to do, scanning files in a single workflow instead of checking each file from external sources one by one.
Combining multiscanning with CDR strengthens my data security operations by providing deeper detection and safer file outputs before files enter the environment.
The recent enhancements to policy orchestration and engine parallelization have improved workflow automation by making it faster and more reliable.
What is most valuable?
In my view, the strongest feature of MetaDefender is the layering, combining multiple antivirus engines with Content Disarm and Reconstruction.
For my daily operations, CDR stands out most because it directly reduces the risk from incoming documents, which is a constant pain point.
I am using the expanded file type and archive coverage feature, which lets me inspect different types of files rather than just common formats, improving my security coverage.
I use enhanced reporting and audit visibility features, which help me keep clear records of file scans, detected threats, and sanitization results for audit purposes.
My impression of the detection rates provided by MetaDefender's multiscanning is quite positive, as using multiple antivirus engines increases the likelihood of catching threats.
I see deep CDR as one of the most valuable features of MetaDefender, effectively removing malicious content while reconstructing clean, usable files.
The solution effectively enforces security policies around file handling by combining multiple antivirus engines and deep CDR to identify and sanitize suspicious files.
I think the file-based vulnerability assessment feature is valuable, as it helps identify potential security risks in files before they are deployed into production.
I understand the purpose of adaptive sandbox analysis and its benefits for analyzing suspicious files, which adds context for investigating unknown threats.
What needs improvement?
MetaDefender is strong, but integration with SIEM and SOAR platforms could be smoother, and faster scanning for large files would be welcome.
A clearer user interface would make MetaDefender more intuitive, along with more detailed documentation, implementation guides, troubleshooting resources, and quicker technical support.
I subtracted two points mainly because of the user interface and reporting limitations, alongside some performance lag when scanning larger files.
For how long have I used the solution?
I have been using MetaDefender for around three years, focusing on cybersecurity operations and Linux administration.
I have worked with MetaDefender for a few months, mainly around file sanitization and scanning workflow, integrating it into my security stack, and testing CDR outputs on typically official documents.
What do I think about the stability of the solution?
MetaDefender has been stable in my environment, maintaining consistent performance post-integration with no major outages.
What do I think about the scalability of the solution?
In my experience, MetaDefender demonstrates good scalability, able to handle increasing file scanning requirements through automation.
How are customer service and support?
The customer support for MetaDefender has been responsive and helpful whenever I had questions or needed assistance.
Which solution did I use previously and why did I switch?
I previously relied on traditional antivirus tools but switched to MetaDefender because it provides a more comprehensive security approach.
What was our ROI?
I have seen a positive return on investment with MetaDefender, improving efficiency by reducing manual work and allowing my security team to focus on important tasks.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing for MetaDefender has been fairly reasonable, offering good value for its security capabilities.
Which other solutions did I evaluate?
Before choosing MetaDefender, I evaluated several antivirus alternatives and found that it combined multiple scanning engines and Content Disarm and Reconstruction in one solution.
What other advice do I have?
I would rate MetaDefender an 8 out of 10, as it offers strong malware detection, effective file sanitization, and useful integration, but still has room for improvement.
I think MetaDefender's AI capabilities are helpful for spotting suspicious files and detecting threats while emphasizing the importance of data privacy, transparency, and access control.
MetaDefender generally meets my expectations in terms of accuracy and reliability, bolstered by the multiple antivirus scanning engines that enhance confidence in identifying malicious files.
I primarily use an on-premises deployment of MetaDefender for better control over sensitive files and integration with my existing Linux-based infrastructure.
I advise others looking into using MetaDefender to assess their file transfer workflow and carefully plan the integration into their existing infrastructure.
reviewer2917575
Advanced file checks have strengthened web content security and improved threat visibility
Reviewed on Oct 24, 2026
Review provided by PeerSpot
What is our primary use case?
My current use cases for MetaDefender are providing security to web content and file security over our internal application hosted externally where end users are uploading files on our website. I ensure that files are scanned on MetaDefender Core using MetaDefender ICAP.
A quick example of when I used MetaDefender is when we had an internal shared drive folder that was publicly exposed and our clients were using that shared drive. When they uploaded their designing documents or ZIP files, if the file had a malicious hash value, MetaDefender would break that hash value, break that ZIP and find the hash value. According to the antivirus engine's scan verdict, it would block that file.
Apart from that, for web content using HTTP protocol, we monitor the POST method. Whatever request is carrying, such as XML script or JavaScript, is also scanned by MetaDefender. If someone tries to make code changes over the publicly hosted applications, MetaDefender Core will block it by determining that the particular request is not a valid request.
How has it helped my organization?
MetaDefender has positively impacted our organization as we have noticed that end-users, clients, or hackers attempting to upload any malicious content towards our URL or application can be detected easily, and we have good exposure and visibility towards those particular threats.
I must say that there are faster responses in scanning the file and providing the verdict of that particular file. Accordingly, it takes action to block or allow that file. If it has been detected as clean reputation, then it will be allowed, and there would be no specific things needed to be done. However, if the hash value is detected by any of the engines as malicious, then it will be blocked immediately.
The integration of multi-scanning and Content Disarm and Reconstruction with MetaDefender has made things much easier and more secure.
What is most valuable?
The best features that MetaDefender offers are providing multiple scan engines, so if one scan engine fails to scan the file or the hash value is mentioned as clean according to one scan engine, yet that file is malicious, then another engine may detect that as malicious according to their current signature. There are multiple scan engines, around eighteen, so even if one detects the file as malicious, it will be blocked. That feature is very useful.
Additionally, MetaDefender is providing AI content detection, so if a file, image, or something that is created using an AI tool, it will detect that file by breaking that value and hash values.
Apart from that, MetaDefender provides workflow settings where I can control the request and how I want to proceed with the scanning, the timeout settings I can provide, ZIP file settings, and how I want to perform scanning on archive files. I can also see that visualization in the console itself. All these are very good features, and apart from MetaDefender, I haven't seen any product have these features.
Regarding MetaDefender's AI capabilities, it provides AI content detection based on their scan engines and all those verdicts. It provides detection for PNGs, JPEGs, or any file that has been created using an AI tool. This is the only feature I have worked on so far.
The accuracy and reliability of the output from MetaDefender's AI capabilities are consistent, and I don't think they are failing to detect actual AI-generated files.
Since we have much more resources than requested for MetaDefender, I'm not seeing much impact on the archive file scanning.
For audit visibility, there is an option for checking the audit event, so we can extract that report as well. It helps us find out what changes have been made and if our compliance policy and configuration are up to our compliance policy or not. Using audit logs, we can validate those things.
Deep CDR is a strong feature of MetaDefender that we have configured using a sandbox license. While it is scanning the file, it breaks the file and checks each component of that file. By using the sandbox feature, it will isolate the particular file temporarily and check whether anything suspicious is detected. If there is a malicious threat, it will remove that and reconstruct the file, providing the copy to the user. That is a very strong feature provided by MetaDefender.
The effectiveness of the solution in blocking or sanitizing content based on policy has totally met our expectations, as we have already configured the workflow according to our use case. It takes action against the files based on our configured settings.
What needs improvement?
Currently, MetaDefender doesn't have a feature such as providing the applications that are under scanning on ICAP and MetaDefender Core. I think that feature needs to be included in future versions because it is configured behind the proxy, and MetaDefender team will not have an idea of which application is there because you can't see that in the dashboard. You have to check the processing history, and there you can check which request is coming and which application traffic is coming. So we can't have an overall view for these particular settings. I think they need to work on this feature so users have consolidated data for the applications that are already integrated with MetaDefender Core for scanning purposes.
Apart from this, I think the archive extraction is taking much more time even if we have much more than enough resources. I'm not saying the required specifications needed for particular scan engines need to be met, but we are having much more resources than requested. However, still for archive extraction and scanning, it is taking much more time, causing latency in the current request flow, and most of the files are in queue for two, three, or five seconds, depending on the size of the archive file. Based on their settings, other files have been impacted. They need to work on this as well so that when the archive extraction is happening, it should not impact other requests which MetaDefender is handling currently.
The detection rates provided by MetaScan multi-scanning are effective, but sometimes we see that a file is genuine, and users complain of no harmful hash value that needs to be detected as malicious or a threat. However, even with our license of all eighteen AV scan engines, some genuine files are detected as malicious because of the configuration that says even if one scanning engine detects a file as malicious, that file will be blocked. This sometimes causes issues for us.
For how long have I used the solution?
I have been using MetaDefender Core and ICAP products for approximately 1.6 to 2 years.
What other advice do I have?
On a scale of one to ten, I would rate MetaDefender an eight.
I gave it an eight because of the two things I already mentioned where they want to work. I can still say nine is perfect, but I will not give ten as I am not satisfied with these two features only. Apart from that, the product is very strong and performing well in the field of file security and web content security.
We do not use adaptive sandbox analysis; we have an on-premises sandbox.
M Kopeichikov
Automated file scanning has protected chat workflows and strengthened daily security checks
Reviewed on Oct 19, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for MetaDefender is to scan files from chats on a day-to-day basis, because sometimes most of the people are sending something possibly malicious via web chats, and I need to be sure that everything that comes in and comes out of that chat is legitimate and won't affect our company's computer servers.
MetaDefender fits into my workflow for scanning files automatically. We have two MetaDefender Cores working together, and the scanning is working automatically, fast, and smoothly, while we can manually take some files from the quarantine if needed. Everything is automated with the API, so that is how we actually use it.
During my studies, I don't really trust files from the outside, even from my professors or the internet, so I constantly scan them in MetaDefender Core and I appreciate the results. I appreciate how fast it works, and it is easy to manage, implement, and work with.
How has it helped my organization?
MetaDefender has impacted my organization positively because we hear from our customers that everything works fine. I don't have a lot of support tickets about things being broken or working poorly and don't need to upgrade the whole system every week, so everything is great.
The outcomes from using MetaDefender Core include scanning metrics reaching a few milliseconds if you know how to configure it right. This year, I received a few tickets about configuration requests, but none regarding something being broken. Everything worked well and smoothly.
What is most valuable?
The best features MetaDefender offers in my experience include how easily it installs and the great GUI that I find excellent, even though I feel quite confused with the new version. I appreciate how everything connects smoothly, which allows my workflow to cover more directions in my company.
I find the new GUI confusing only because I am used to the previous one. While it is common to need time to adjust to a refreshed GUI, overall, the GUI is still one of the best I have ever seen. Connecting different modules is easy to do, just as installing on your Linux or Windows system and configuring it to work out of the box is straightforward.
I have a great impression of the detection rates provided by MetaScan multi-scanning. It is one of the best I have ever seen.
I assess the effectiveness of Deep CDR in reconstructing files safely and without signatures as a ten out of ten, as I really appreciate how it is done.
The file-based vulnerability assessment feature is useful for identifying potential security risks before deployment, as it helps to detect vulnerabilities at an early stage and reduces the risk of introducing vulnerable components into production environments.
We use the adaptive sandbox analysis, and I appreciate it because it operates on a separate server, MetaDefender IFR. I appreciate the GUI, the design, and the overall reports it generates.
We are using the enhanced reporting and audit visibility features because the reports are very colorful and everything we need is beautifully presented.
I assess the effectiveness of the solution in blocking or sanitizing content based on policy as a ten out of ten.
What needs improvement?
MetaDefender could be improved by enhancing the Central Management feature because sometimes when I need to make configurations inside MetaDefender Core, it is blocked, which necessitates accessing Central Management. I suggest allowing more settings to be adjustable directly in MetaDefender Core itself.
For how long have I used the solution?
I have been using MetaDefender Core for a year now, and in addition to Core, I also use other solutions such as Email Gateway Security, MetaDefender IFR, and ICAP.
What do I think about the stability of the solution?
MetaDefender is one hundred percent stable.
What do I think about the scalability of the solution?
MetaDefender's scalability is straightforward. You can scale by adding multiple MetaDefender Cores that work as a cluster, but you need an external load balancer for this purpose.
Which solution did I use previously and why did I switch?
We used to use FortiSandbox, but we switched to MetaDefender because it is simply better.
What was our ROI?
I cannot share any relevant metrics about return on investment as we are not counting that information.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing has been excellent. When I ask for the price, it takes less than an hour to get all the information I need, and everything is fast.
Which other solutions did I evaluate?
Before choosing MetaDefender, I cannot really remember evaluating other options besides FortiSandbox and MetaDefender Core, but we ultimately chose MetaDefender Core because it was better.
What other advice do I have?
I have not used MetaDefender's AI capabilities at all because this is a new feature, and both our customers and I have not utilized AI in MetaDefender.
I think the AI capabilities and accuracy of MetaDefender should be at the top based on my expectations, as the product overall is excellent.
My advice for others looking into using MetaDefender is to install it on either a Linux or Windows system, conduct your tests, explore, and you will see that MetaDefender Core is an excellent product.
I rate MetaDefender a ten out of ten.
Seguntaiwo Tao
Endpoint security has improved and remote control now protects devices with swift threat recovery
Reviewed on Oct 13, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for MetaDefender involves managing endpoints and malware detection and vulnerability assessment. It is an encompassing platform that performs vulnerability assessment, endpoint protection, and malware detection.
We were tasked to protect some endpoints, and they wanted everything to be reported to a particular dashboard, so we had to deploy the agent on each device. The deployment was very seamless, and as an admin, I could do a whole lot of things, such as disable ports, perform DLP, and use many features including Content Disarm and Reconstruction, which is very effective. We also used it on mobile devices.
The main use case was simply protecting the endpoint and being able to do a whole lot of things remotely on those endpoints because the agent is sitting on them. It is very good for remote working, and you can be assured that your devices are protected with MetaDefender.
How has it helped my organization?
MetaDefender has positively impacted my organization by reducing the number of attacks we receive. Most of the attacks we got before we started using MetaDefender were unpremeditated and unplanned. Now, using MetaDefender, we can rest assured that we have excellent endpoint protection, which is more advanced than regular antivirus. This has helped us reduce our expenditures, and our users can work freely without the risk of getting attacked.
The mean time to restore has really gone down. Before MetaDefender, it could take more than an hour depending on the kind of impact, but now, in less than ten minutes, we are back up, which is very good.
What is most valuable?
The best feature MetaDefender offers is Content Disarm and Reconstruction because if there is malware in a particular file and the agent is sitting on it with Content Disarm and Reconstruction enabled, it is going to remove the malware and give you the exact file you need without you even being aware, which is a very good technology.
One of my experiences with Content Disarm and Reconstruction is that I intentionally wrapped a payload into a file and sent it to a particular device on the network to see if this really works. Upon the user clicking it, it was supposed to ransom the user's computer, but it was able to tell the user that this is a malicious file and it would undergo Content Disarm and Reconstruction. Upon clicking, it removed the payload and gave the user the real file beneath the wrapped malware.
Regarding my main use case and how I use MetaDefender, the use of DLP is very important because I work in a setting where you do not want users to exfiltrate your data. Some ports have been shut down, such as USB, and we do not allow external USB devices. DLP helps us to make sure that the USB port will be disabled, and you can also shut down the device if it is stolen. You can run malware detection periodically, and you can configure a lot of policies, which I was able to do using MetaDefender on those devices.
Regarding MetaDefender's AI capabilities, I think the governance and security are good. It is compliant and gives you an overall score of your device to see if it is compliant.
MetaDefender has been dependable for me because if I come into contact with a roadblock, I can ask the AI, and it really helps me twenty-four hours a day, seven days a week.
My impression of the detection rates provided by MetaScan multiscanning is that they are very reliable and can be trusted. While using it, I switched off my Windows Security to see if it would detect threats, and it did, providing recommendations that help you manage your security effectively.
I use adaptive sandbox analysis, which places the file into a sandbox to see its behavior, and it gives me the metric for it. Regarding file-based vulnerability assessment before deployment, it performed a vulnerability scan and provided patches without me having to look for them, and all patches were easily applied from the console screen.
What needs improvement?
I hope that MetaDefender could improve by integrating more advanced features that are not currently available. I understand it is still OPSWAT, but I wish it could be more encompassing.
I would like to see specific advanced features, such as Kiosk, which I have not reviewed but I know OPSWAT has different features apart from MetaDefender that might be more advanced. However, MetaDefender is very good for SMBs and medium-level businesses.
The effectiveness of Deep CDR in reconstructing files safely and without signatures works, but for bigger files, it takes a long time. Sometimes, I have to strike a balance between scanning the file and a user needing it, but I know it does work, especially when using behavioral analysis and sandboxing.
For how long have I used the solution?
I came across MetaDefender during one of my projects where we had to secure some endpoints and needed endpoint protection. It has been about several months ago, and it has been really great so far.
What do I think about the stability of the solution?
MetaDefender is stable and reliable during use. It is very easy to uninstall and off-board, and it protects mobile devices, an area where most other solutions have not been able to perform well.
What do I think about the scalability of the solution?
The scalability of MetaDefender is very good. It scales well as my organization grows, allowing for adjustments as needed, and it does not have a pay-as-you-go pricing plan.
How are customer service and support?
Customer support is very responsive, reaching out to me back in less than ten minutes during their work hours. There is also an AI chatbot that can provide solutions or escalate to the support team if needed. I give their customer support a perfect score of ten out of ten.
Which solution did I use previously and why did I switch?
Previously, we used different solutions such as Qualys and Nessus, and we are currently using ManageEngine to see the features of these products and make a decision. Not that either solution is bad, but we need to choose what is best by trying each of them.
How was the initial setup?
Nothing much is needed for improvements since it was linked with Active Directory, allowing all our computers online to receive the agents. We also used startup scripts to automatically start the deployment when all devices come up, so the deployment was great.
What was our ROI?
I cannot assess the return on investment with MetaDefender since we never invested in it. We only used the trial, and I can answer that once we make a decision on whether to proceed with it.
What's my experience with pricing, setup cost, and licensing?
I started with a thirty-day trial for pricing and setup costs. Right now, we are in the process of comparing ManageEngine and MetaDefender because we are currently using ManageEngine Endpoint Central.
Which other solutions did I evaluate?
Before choosing MetaDefender, I evaluated it against Nessus and Qualys, and now we are using ManageEngine Endpoint Central.
What other advice do I have?
I rate MetaDefender a nine out of ten. I chose nine out of ten because it loses that one point due to the advanced features that are probably not there and also the pricing. We used the trial method first to test the product, and for the job I needed it to cover for the SMEs, it was able to cover all the endpoints and do the job well.
Honestly, I have not reviewed the enhanced reporting and audit visibility features, nor have I tried automating it, but it is something I am planning to do to ease my job as an administrator.
My advice for others looking into using MetaDefender is that it is a great product with a lot of features your organization would need. The policies are easy to control, and navigation is not hard at all. Additionally, it does not take much CPU. My overall rating for MetaDefender is nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Sandeep Parmar
File security has improved as we scan uploads pre-server and block corrupted content
Reviewed on Oct 11, 2026
Review provided by PeerSpot
What is our primary use case?
The main use case for MetaDefender in the project with B****** is to ensure that files are scanned before sending them to the server, where I created a Java-based service that checks for viruses.
In the project with B******, my main use case for MetaDefender is to scan files that use Excel uploads and basic file uploads to prevent any virus infections, so I send the file bytes to MetaDefender APIs and check for viruses.
I do not know much about Deep CDR, as my integration is mostly for scanning viruses, and we just block files that are corrupted or harmful without reconstructing them.
How has it helped my organization?
MetaDefender has positively impacted B****** organization, as their security has increased significantly by scanning all the files in their environment before sending them to the servers.
I cannot share any specific outcomes or benefits that B****** has seen, as that is an internal organization matter.
What is most valuable?
In my experience, the best feature that MetaDefender offers is its perfect documentation, which is critical for API integrations to ensure files are not corrupted or infected with viruses.
I would add that for the dashboard, while I have used it, I am more fascinated about the API. It is good that we can manage users from one console, and I can see the history of uploads and whether the files are corrupted or not.
I think the detection rates provided by MetaDefender through multi-scanning are good, as it stops almost all of the virus files I have uploaded.
MetaDefender effectively blocks the harmful content based on our policies, as this is working perfectly fine for me, though I cannot share specific policies.
What needs improvement?
In my opinion, MetaDefender could improve its async version of their APIs, as the documentation is not that good for the async APIs and can be a bit complex to navigate for integrations.
Regarding needed improvements for MetaDefender, I think the dashboard could benefit from features that allow tracking IPs from where files are coming, which would enable blocking potential attackers.
I reported this issue, and while it is not directly MetaDefender's fault, it highlights a potential area where they could prevent misconfigurations.
For how long have I used the solution?
I have been using MetaDefender for a project with an Indian client named B******, which is a big client, and they have requested us to integrate MetaDefender with their current flow.
What do I think about the stability of the solution?
I think MetaDefender works as expected without major issues, and I faced one, but it was due to the integration provider, OPSWAT.
There was an incident regarding the sending of hardcoded API keys, which caused me to receive unauthorized errors due to the overriding API key issue from OPSWAT.
In my experience, MetaDefender has been stable, as I have not noticed any downtime while my application uses it 24/7.
What do I think about the scalability of the solution?
I do have concerns about scanning larger file sizes, like 400 MB, since we have set a maximum limit of 65 MB, and I would be worried if we were to increase this limit.
How are customer service and support?
I have not had to reach out to MetaDefender for customer support.
Which solution did I use previously and why did I switch?
I did not use a different solution before MetaDefender, as there was no prior solution.
How was the initial setup?
I think my use case with MetaDefender fits into my workflow well, as it is quite easy to integrate, thanks to the thorough documentation, and we took about two or three days to integrate all of MetaDefender's APIs.
What was our ROI?
I have not seen a return on investment regarding time or money, but the implementation of MetaDefender provides an essential security layer that blocks potential threats.
What's my experience with pricing, setup cost, and licensing?
Regarding pricing, setup cost, and licensing, I cannot provide specifics since it falls under B****** and OPSWAT's management, but from my perspective, the per API hit cost is a factor.
Which other solutions did I evaluate?
Before choosing MetaDefender, I did not evaluate other options, as it was a decision made by the higher management, and my role was to integrate it.
What other advice do I have?
I would rate MetaDefender around seven to eight because I have used their file scan feature, though I have not fully explored all their capabilities. I would give it a seven or eight because I have not used all the functionalities provided, and I deduct a point for the async API documentation which could be better.
Regarding MetaDefender's AI capabilities, I believe they manage governance and security policies quite well, especially since B***** is a large and reputable firm.
MetaDefender is deployed on-premises in the organization, and there is also a trial version available on the cloud, but we are currently only using on-premises.
My advice to others looking into using MetaDefender is to read the documentation first before implementing anything. I would rate MetaDefender an eight out of ten overall.
Pradeep Dubey
Centralized endpoint checks have secured global access to sensitive corporate resources
Reviewed on Oct 05, 2026
Review provided by PeerSpot
What is our primary use case?
Before accessing the company's protected resources, it is being scanned through MetaDefender Endpoint, which scans the local operating system and machine before the request actually hits the company's protected resources.
MetaDefender Endpoint has been installed in the Windows operating system machine, and before accessing any protected resource of the company, MetaDefender scans the request and the resources, and it even scans the local machine. If there is any vulnerability or any kind of malware, then it immediately blocks the resource and does not allow access to the protected resource for the company. In this case, it is the company's protected resource, so access is not allowed. It checks the software and checks the various software that is installed in the machine, and if all are acceptable, then only MetaDefender is allowed to access the protected resources.
For companies that are widely distributed and have resources with company employees widely located across the world, it provides a centralized, secure platform before accessing any protected resource. This is a mandatory software that everyone should install in their machine and ensure that it passes all the quality checks, making it a strong platform in terms of security and securing protected resources.
How has it helped my organization?
MetaDefender is fundamentally a security platform. All resources that are company proprietary resources are secured with MetaDefender Endpoint, and this is what was desired at the company level. It is mandatory for each and every resource in the company located across the globe to be scanned by MetaDefender Endpoint before accessing these protected resources.
All employees in the organization are keeping their machines up to date; all software is regularly upgraded. For example, browser versions or other software such as Notepad++ are being upgraded. They are also conducting full Windows scans, meaning they are doing complete security full scans on their machines on a monthly basis because this is set at the organization security policy where it is mandatory to scan the machine once a month. These security policies are implemented, and MetaDefender is valuing these policies and ensuring that all employees are aligning with the security policy.
What is most valuable?
MetaDefender checks all the software and its latest version, and whether the local software that is installed is aligned with the organization policy that is set by the organization security administrator. MetaDefender passes all this information and checks against those policies that are being set and determines whether the installed software is aligned with the organization policy or not. For example, if any deprecated software or any software that has any kind of malware is in the machine, then it immediately highlights and stops accessing those protected resources.
MetaDefender is always on at startup; it must be enabled during startup of the operating system, and when accessing any protected resource, after authorization and authentication, it immediately checks whether the resource being accessed is allowed for access, and it scans all the software. Whether it is a browser version such as Chrome browser, or if it is having a deprecated or older version, or any operating system software such as WinRAR or Notepad++, any software that is deprecated or has an older version, it will immediately flag that as an error and will not allow access to the protected resources.
This is quite helpful in terms of securing resources; it immediately brings those vulnerabilities or incompatibilities in the system to attention. It also provides the feature to check the status of the operating system or machine status immediately. There is an icon at the taskbar; clicking and rechecking the status of MetaDefender Endpoint shows the current status. If all are acceptable, then it will confirm that all is well, and access to the protected resources can proceed. If there is any issue, it will flag that on the screen when rechecking the status.
MetaDefender highlights all the vulnerabilities the moment of accessing the protected resources, so it scans all the files in the system and brings those issues when clicking the recheck button.
It does the auditing of the local machine and maintains awareness of what is occurring on the machine, specifically from the security perspective. If there is any vulnerability or any kind of malware being deployed in the machine, it immediately stops access to those protected resources.
What needs improvement?
If there is any major vulnerability, then it is understood that it should not allow access to the protected resource. However, if the vulnerabilities are not serious and are at the information or warning level, then MetaDefender should allow access to those protected resources. For example, if using an older Chrome browser version, it should not be a significant security issue. Similarly, older version Notepad++ represents low priority issues that MetaDefender could still allow employees to access the protected resources, but currently, MetaDefender treats these small issues as high priority.
MetaDefender will not automatically open the screen and display vulnerabilities unless the recheck button is clicked, which is something that could be improved. The moment the operating system or machine is opened, it should highlight any issues if there are vulnerabilities rather than waiting for the recheck button to be clicked.
The recheck button needs to be clicked every time. Additionally, low priority issues are taken very seriously and considered blockers. For example, outdated browser versions or any software in the machine that does not have the latest version could be considered low priority if the software is not critical.
The full scan takes considerable time; a complete Windows full scan takes almost 12 hours because it has billions of files. The full scan is time-consuming, and if MetaDefender could scan it more quickly and provide results faster, that would be an improvement.
Regarding improvements, low priority software that is highlighted as a blocker could be reworked to still allow the user to access the protected resources. Additionally, MetaDefender could introduce some kind of workflow or user interface which highlights all issues or vulnerabilities in one place rather than requiring clicking the recheck button and navigating through the browser.
For how long have I used the solution?
This product has been in use for two years.
What do I think about the stability of the solution?
MetaDefender is stable, but it brings or highlights items which are low priority, and software upgrades need to occur very frequently because it checks all the minute details in the operating system and system and brings them forward, necessitating software upgrades.
What do I think about the scalability of the solution?
MetaDefender handles the scale well. There are quite a lot of employees, more than 50,000 employees, and all are using it, making it a quite scalable platform.
How are customer service and support?
Customer service has not been contacted yet because it is a quite stable environment and a stable platform. MetaDefender highlights all the issues and even guides how to resolve vulnerabilities, for example, by installing upgraded software or conducting a full scan. It is quite comprehensive in explaining the issues that are currently encountered.
What was our ROI?
MetaDefender Endpoint has provided benefit from its use. The company's resources are fully protected and secured; no unauthorized access can reach the protected resources. All resources are now secured, and MetaDefender Endpoint can be trusted in this area.
What's my experience with pricing, setup cost, and licensing?
The setup and pricing are managed at the organization level, and the security department or the infrastructure department would have better knowledge of costing and pricing.
Which other solutions did I evaluate?
Previously, the authentication and authorization method was using Azure Active Directory, or Azure Entra ID, and now MetaDefender is also used along with Azure AD.
What other advice do I have?
From the security perspective, I would rate it an eight. MetaDefender is on-premises and managed by the company's platform. For any company where resources are widely located across the globe, MetaDefender Endpoint should be considered as one of the security platforms that ensure all protected resources are very much secure.
Sriparna Banerjee
Advanced file sanitization has strengthened threat detection and protects daily content workflows
Reviewed on Oct 04, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for MetaDefender is for security purposes, as we are a cybersecurity team, and currently we are using it for purposes such as antivirus scanning and other security measures.
In my day-to-day work, we are working with a company called Opswat, and we have devices, so to keep everything clean and clear, we are using MetaDefender as an antivirus firewall. We are inserting this MetaDefender chip for scanning purposes and using it as a firewall as well, but I do not have much knowledge about it because I am in a non-technical role right now.
In terms of using MetaDefender, we are utilizing it for threat detection, multi-scanning, and enterprise security.
How has it helped my organization?
MetaDefender has impacted my organization positively by adding an extra layer of security to our file and content handling process, and through its CDR, it ensures that files are sanitized before they reach our environment, which has improved our security posture.
I have noticed that the confidence and security of file processing have improved, with multi-engine scanning providing threat detection, and the security checks help us identify malicious files before they enter our environment, although I have not yet observed a specific, quantified business impact.
What is most valuable?
In my experience, MetaDefender offers a Deep CDR, and other major strengths include multi-scanning, Tri-tech AI, Adaptive Sandbox, Proactive DLP, and file vulnerability assessment.
Out of those features, I find myself relying on Deep CDR the most because it is one of MetaDefender's key differentiators; it does not depend only on detecting known malware but sanitizes and reconstructs files to prevent potentially malicious content, including zero-day threats, from reaching the environment.
Regarding MetaDefender's AI features, I think it handles data responsibly and keeps things secure by providing protection in multiple layers through malware scanning, threat detection, and content sanitization, which helps organizations manage security risks while maintaining a good balance between security, control, and compliance.
I find MetaDefender's AI capabilities to be reliable and useful as an additional layer of threat detection, with results that have been generally consistent and provide useful insights when analyzing files, though I have not used the AI capabilities long enough to independently measure accuracy.
My impression of the detection rates from MetaDefender's Metascan Multi-scanning has been positive; using multiple scanning engines provides broader coverage and greater confidence that potential threats will not be missed, and while I have not independently measured the detection rate, the results I have seen are consistent and useful for identifying potential malicious files.
I assess Deep CDR as highly effective in reconstructing files safely and without signatures because it focuses on safely reconstructing files rather than relying only on traditional malware signatures, which is particularly valuable for handling unknown or potentially zero-day threats while keeping reconstructed files usable.
I think the file-based vulnerability assessment feature is valuable because it helps identify potential vulnerabilities before files or applications are deployed, providing an additional preventive security layer that helps organizations address risk earlier rather than discovering them post-deployment.
We are using the reporting and audit visibility features to gain better visibility into scanning activities and results, which help provide a clearer record of what has been scanned and the outcomes, aiding in tracking and audit purposes from an operational perspective.
What needs improvement?
One area where MetaDefender could improve is by making the user experience more intuitive, especially for new users, with clear guidance, simpler navigation, and a more detailed explanation of scan results and outcomes, which would enhance the effectiveness for users, while better onboarding and learning resources would help users get familiar with the different features more quickly.
The usability and onboarding are my main concerns, as I do not have much overview on the technical aspects.
For how long have I used the solution?
I have been using MetaDefender for two to three months.
What other advice do I have?
MetaDefender offers strong security capabilities and multiple layers of threat detection, but since I am still relatively new to this platform, I would explore more of its features before giving it a higher rating. Even though MetaDefender provides a strong, multilayered security and is quite useful and comprehensive, the user experience on onboarding and the clarity of scan results could be simpler, especially for new users.
My advice to organizations looking into using MetaDefender is to seek an additional layer of security around file and content handling, as it is a great choice with multi-engine scanning, CDR, and vulnerability assessment capabilities providing good overall coverage. It is important to clearly understand your organization's security requirements and take time to explore the different features and integrations to get the most value from the platform.
I would rate MetaDefender as an eight out of ten.
JaiminDalwadi
Advanced file checks and deep sanitization have prevented threats at the entry point
Reviewed on Sep 14, 2026
Review from a verified AWS customer
What is our primary use case?
MetaDefender prevents organizations from file-borne malware and file-borne threats by preventing threats at the entry point itself.
What is most valuable?
MetaDefender's threat detection ratio is quite high because it uses multiple anti-malware engines. Sanitization helps eliminate typical zero-day threats such as macro-based attacks and script-based attacks.
Deep CDR feature in reconstructing files has provided significant value to customers. When they receive phishing links, dummy QR codes, or embedded actions defined on documents, Deep CDR removes all those potential threats.
MetaDefender supports all expanded file type and archive coverage features, which means most of the 4,000-plus file types are covered. It provides a quite deep scanning process. Archive extraction gives more visibility of the files.
The file-based vulnerability assessment feature is straightforward. When downloading a file from the internet and scanning it, information about known vulnerabilities is provided. It gives advanced information about the vulnerability.
With MetaScan multi-scanning feature, certain web shell attacks can be detected which others cannot. Whether it's 8 anti-malware engines or 20, the detection ratio and rate are quite good.
What needs improvement?
Reporting still requires improvement, but otherwise the solution is excellent. Other areas include centralized management, providing the capability to manage all instances from a single console, centralized reporting, and integration through central management.
For how long have I used the solution?
I started working with MetaDefender in 2021.
What do I think about the stability of the solution?
Uptime is 99.99%, so it is 99% stable and reliable.
What do I think about the scalability of the solution?
Scalability with MetaDefender is very good.
How are customer service and support?
Support is excellent. Technical support from OPSWAT is excellent.
Which solution did I use previously and why did I switch?
We are not working with Trend Micro, also called today Trend AI Vision One, which is hardcore competition. We are purely working on MetaDefender.
How was the initial setup?
Installation for the deployment of MetaDefender is straightforward.
What was our ROI?
Many threats are prevented before entering the organization with MetaDefender. It definitely saves more effort for the SOC team if threats are being eliminated at the entry point itself, allowing them to focus more on other things.
What's my experience with pricing, setup cost, and licensing?
MetaDefender is affordable. It is flexible, and pricing-wise there are no concerns with this solution.
Which other solutions did I evaluate?
When comparing MetaDefender to other solutions, I compare it to Trend Micro, Broadcom, and Check Point for email.
What other advice do I have?
MetaDefender is leading with respect to competitors as an all-in-one platform because no other tool has all the platform built-in.
For example, MetaDefender cannot identify the source itself, but if a file is scanned, the complete detail of the scanning can be seen.
If someone modifies a policy, adaptive sandbox analysis takes a little bit of time, but it gives accuracy up to 99%.
Continuous improvement that OPSWAT is doing with enhancements made to policy orchestration and to engine parallelization demonstrates that OPSWAT is adapting.
I rate this solution a 10.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Prajwal Chougale
Multi-layered file analysis has strengthened our email defense and reduced manual SOC effort
Reviewed on Sep 09, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for MetaDefender is for multi-scanning purposes, including Deep CDR, sandbox-based analysis, and protecting the organization from malware and other file-based threats delivered through email, particularly suspicious or unknown attachments. I primarily view it as an additional inspection layer for email attachments, using its multi-scanning capability to analyze files with multiple detection engines. The Deep Content Disarm and Destruction capability is also valuable because it can remove potentially malicious content from supported files and provide a safer version for the user. From a SOC's perspective, this is particularly useful for handling files that may bypass traditional signature-based security controls while email filtering is happening. It gives us additional confidence when dealing with documents such as PDFs and Office files and all other materials that we receive through email. MetaDefender prevents malicious or weaponized files from reaching users while reducing the risk associated with unknown, zero-day file-based threats.
What is most valuable?
The best features of MetaDefender include multi-scanning, multi-layered scanning of any email or attachment, the CDR feature, and the sandboxing analysis capability. The multi-scanning feature is particularly useful because a file can be checked against multiple antivirus engines instead of relying on a single detection engine. Deep CDR is one of the strongest features because instead of only detecting whether the file is malicious, it can sanitize supported files by removing potentially dangerous content and reconstructing a safe version. This is especially useful for documents and email attachments where we still need to allow the business to work with the file. The adaptive sandbox is another valuable feature for files that require deeper behavior analysis, providing another layer for identifying suspicious or malware-like content that may not be obvious through the traditional scanners that we use.
MetaDefender has a positive impact by adding multiple layers of file scanning, email classification, and attachment investigation in a more efficient way. Instead of just relying on the verdict from our primary email or endpoint security solution, we can use MetaDefender to get additional analysis across multiple engines. This is especially helpful when dealing with suspicious or previously unseen files, zero-day attack files. Deep CDR has also been useful from a risk reduction perspective because potentially dangerous content can be removed from supported files while still allowing users to work with a usable version of the document. Overall, MetaDefender has a positive impact on analysis and detecting suspicious files, leading to greater confidence in our environment. It has also helped reduce some of the manual efforts involved in determining whether the attachment is safe or not.
What needs improvement?
MetaDefender is quite better in all aspects it has been designed for. We could enhance the user interface and user experience, as the platform has many security capabilities, but some configuration and policy management tasks can take time to understand, especially for someone using the product for the first time. I would appreciate more intuitive reporting and dashboards. The security information is useful, but making key metrics, detection trends, false positives, and remediation actions easier to understand would help a SOC team quickly identify areas requiring attention. Another area for improvement would be reducing false positives and improving processing time for large or complex files, which sometimes may require additional manual review. The CDR is a very useful tool, but clearer handling and exception management should be implemented when sanitizing legitimate files. Automation and integrations could also be enhanced, particularly around recommending appropriate actions based on scan results and simplifying integration with other security tools.
For how long have I used the solution?
We have been using MetaDefender for more than two years.
What do I think about the stability of the solution?
From my overall experience, MetaDefender is a very stable and reliable product when it comes to the outcomes of file analysis and email attachments received. In my day-to-day experience, I have not encountered any major stability issues that would significantly affect email or file security operations. The core functions, such as multi-scanning, sandboxing, and file inspection, have been consistent. Once the policies and integrations are configured properly, there is minimal ongoing maintenance required to keep the solution operational. I would monitor its performance when handling very large or complex files, as scanning can sometimes take longer.
What do I think about the scalability of the solution?
MetaDefender can handle any traffic and is suitable for any organization regardless of size. With our security requirements, we can achieve this with the existing environment and scale without requiring redesign or re-architecture. Its main advantage is the flexibility in deployment, allowing it to be deployed in the cloud or on-premises. Additional instances can be added as email volume and the number of protected users increases. Overall, I consider MetaDefender to be highly scalable and suitable for any growing organization of any size, with the main requirements being proper planning for traffic and security workloads.
How are customer service and support?
Their customer support is outstanding. Whenever we raise any support case, they provide complete structural descriptions and solutions to the problems we report, and they resolve issues on the spot. I would rate them nine out of ten.
Which solution did I use previously and why did I switch?
We were previously using Evinent as a security tool, and we incorporated MetaDefender for extensive EDR plus email security.
How was the initial setup?
The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.
What about the implementation team?
We are a customer.
What was our ROI?
We have reduced some of our manual effort and saved time, even investing additional time on zero-day attacks. In file analysis, we have sometimes saved a lot of time, while also spending a little more on suspicious files. Overall, using MetaDefender has been beneficial and can be justified as a positive investment.
Which other solutions did I evaluate?
The decision to switch to MetaDefender was mainly taken by higher management, and as a SOC analyst, I was not involved in the evaluation of other options.
What other advice do I have?
If you are looking for a solution that enhances your email security or your EDR product, and if you are considering more security solutions that can protect both combinedly, I would recommend MetaDefender as one of the best tools. Its features include multi-scanning, Deep CDR, sandboxing, and file investigation, which are essential for effective detection while minimizing false positives and scanning times. Integration with the existing environment is also important; if you are using Microsoft 365, ensure that flow connectors and policies are planned and tested before moving into production. I would also check for potential conflicts or mail loops if another third-party email security solution is already deployed. Another recommendation is to spend time on policy tuning and user group segmentation. MetaDefender allows policies to be prioritized and applied to specific audiences, making administration much easier as the environment grows. I would recommend this approach as well. My overall rating for MetaDefender is eight out of ten.