ANY.RUN shares bank sandbox stats and MSSP claims

ANY.RUN cites a bank’s 12.8% malicious sandbox yield and separately markets MSSP automation and threat feeds.

On October 13, 2026, ANY.RUN published aggregated sandbox statistics from 74,086 analyses by an anonymized financial organization between March 30 and June 22, 2026. Of those runs, 8,520 were malicious, 992 suspicious, and 64,574 clean, for a 12.8% malicious yield close to the 13.0% banking-sector median. Files were far riskier than URLs (58.8% versus 25.6% malicious), with PowerShell scripts at 88.2% and MSI installers at 75.2%; median detection time was 15.1 seconds versus 16.9 seconds for the sector. Two days later, ANY.RUN published a separate marketing post aimed at MSSPs, arguing that manual phishing and malware work does not scale as clients grow and promoting Interactive Sandbox automation for CAPTCHAs, redirects, and QR codes plus TI Lookup built from more than 700,000 professionals and 16,000 organizations. That post claims automatic Tier 1 reports cut escalations by 30% and Tier 1 investigation time by 20%, and pitches TI Feeds for SIEM, SOAR, and TIP enrichment. The two posts do not contradict each other; they cover different claims, and the second does not cite the Q2 financial-organization figures.

• ANY.RUN published two posts on 2026-10-13 and 2026-10-15: one with sandbox statistics and one marketing MSSP automation.
• One anonymized financial organization ran 74,086 sandbox analyses between March 30 and June 22, 2026 (Q2 2026).
• Of those, 8,520 were malicious, 992 suspicious, and 64,574 clean, a 12.8% malicious yield versus a 13.0% banking-sector median.
• Files were malicious 58.8% of the time versus 25.6% for URLs; PowerShell scripts were 88.2% and MSI installers 75.2%.
• Median time to detection was 15.1 seconds versus a 16.9-second banking-sector median.
• ANY.RUN says TI Lookup draws on activity from more than 700,000 professionals and 16,000 organizations.
• The vendor claims automatic Tier 1 reports cut escalations by 30% and Tier 1 investigation time by 20%, and that TI Feeds can push malicious IPs, domains, and URLs into SIEM, SOAR, and TIP tools.