ANY.RUN: German Manufacturer Case Study Cites ~15 Minutes Saved Per Alert; Vendor Named G2 Fall 2026 Malware Analysis Leader

Two vendor-published ANY.RUN items: a five-person security team at a German manufacturer protecting 10,000 endpoints reports cutting triage time by roughly 15 minutes per alert after adopting the Interactive Sandbox, and ANY.RUN says G2 named it Grid Leader…

Two consecutive ANY.RUN publications (2026-09-09 and 2026-09-10) describe the vendor's Interactive Sandbox. In the first, Philipp Z., Security Lead at a leading German manufacturer, said a five-person team protects 10,000 endpoints and users with the sandbox in a private cloud. The firm previously relied on a single air-gapped forensic laptop running Flare VM, which caused 5-10 minute setup delays, single-user bottlenecks, and selective triage; after the switch, the team reportedly saves roughly 15 minutes per alert and reduces forced wiping and reimaging of user machines. The piece also cites ANY.RUN data placing manufacturing security workloads 22% above other major industries. In the second item, ANY.RUN announced it was named both Grid Leader and Momentum Leader in G2's Fall 2026 malware analysis rankings, citing customer satisfaction and market momentum. The vendor states the Interactive Sandbox is used by over 700,000 security professionals and 16,000+ SOC and MSSP teams across Windows, Linux, macOS, and Android, and claims faster investigations for 95% of SOCs and MTTR reductions of up to 21 minutes per case. Note: both reports are vendor-published, so the figures are vendor-reported with no independent verification stated; the two items cite different efficiency metrics (15 minutes per alert for one customer vs. up to 21 minutes MTTR per case as a broad claim), which are separate claims rather than a direct contradiction.

• A five-analyst security team at a German manufacturer protects 10,000 endpoints and users with ANY.RUN's Interactive Sandbox in a private cloud (ANY.RUN, 2026-09-09).
• The adoption reportedly saves roughly 15 minutes per alert and has reduced forced wiping and reimaging of user machines.
• Previous setup: a single air-gapped forensic laptop running Flare VM, with 5-10 minute setup delays, single-user bottlenecks, and selective triage.
• ANY.RUN data cited puts manufacturing security workloads 22% above other major industries.
• ANY.RUN says G2 named it Grid Leader and Momentum Leader in malware analysis in G2's Fall 2026 rankings (ANY.RUN, 2026-09-10).
• Vendor claims 700,000+ security professional users and 16,000+ SOC and MSSP teams, across Windows, Linux, macOS, and Android.
• Vendor claims faster investigations for 95% of SOCs and MTTR reductions of up to 21 minutes per case.
• All figures above are vendor-reported (source: ANY.RUN); no independent verification is stated in the reports.