ANY.RUN Publishes German Manufacturer Case Study, Threat Intel Buying Guide, and MSSP Value Guidance — All Metrics Vendor-Supplied

Within roughly 17 hours (2026-09-16 to 2026-09-17), sandbox vendor ANY.RUN released three promotional pieces: a case study of an unnamed German manufacturer whose five-person SOC protects ~10,000 endpoints (vendor-claimed median 15 minutes saved per alert,…

ANY.RUN published three vendor-authored items in two days. (1) On 2026-09-16, a case study describes an unnamed German manufacturer whose five-person SOC replaced an air-gapped forensic laptop with ANY.RUN's cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. Vendor-supplied figures: median 15 minutes saved per alert investigation, 20-40 tasks processed daily, a 2.5-minute target from dangerous alert to endpoint isolation, and 95% agreement between analyst and sandbox verdicts; the customer's identity is withheld, and the writeup includes a reproduced multi-stage phishing chain (PDF link to password-protected ZIP to malware execution). (2) On 2026-09-17, ANY.RUN published a buyer's guide for enterprise threat intelligence platforms, advising SOC/MSSP teams to define requirements first and to weigh intelligence freshness, validation, and enrichment context over database size, plus API capacity, STIX/TAXII integrations, privacy, scalability, and proof-of-concept testing against real alerts; it cites TI Lookup results in about 2 seconds and 99% validated IOCs in its feeds. (3) A same-day blog argues MSSPs should report investigation outcomes, decision speed, and recurring threat patterns rather than raw alert counts, citing company 2026 data: email accounts for 30.3% of MSSP sandbox submissions, customers report 20% less Tier 1 investigation time and 30% fewer Tier 1-to-Tier 2 escalations, and frequently analyzed families include ClickFix, Sneaky2FA, EvilTokens, EtherHiding, and Kali365. All three items are vendor content; all metrics are vendor-supplied, the case-study customer is anonymous, and no independent verification is offered. The reports do not conflict on any stated fact.

• Publication window: 2026-09-16T15:12Z (case study) through 2026-09-17T08:15Z (MSSP blog); all three items are from ANY.RUN.
• Case study subject: unnamed German manufacturer, five-person SOC, ~10,000 endpoints and 10,000 users; identity withheld.
• Vendor-claimed case study metrics: median 15 minutes saved per alert investigation; 20-40 tasks processed daily; 2.5-minute target from dangerous alert to endpoint isolation; 95% agreement between analyst and sandbox verdicts.
• Architecture change in case study: air-gapped forensic laptop replaced with ANY.RUN's cloud-managed interactive sandbox.
• Training example in case study: multi-stage phishing chain reproduced interactively — PDF link to password-protected ZIP to malware execution.
• TI buying guide criteria: define SOC/MSSP requirements first; weigh intelligence freshness, validation, and enrichment over raw data volume; check API capacity, STIX/TAXII integrations, privacy, and scalability; run PoCs against real…
• Vendor-cited TI product figures: TI Lookup results in about 2 seconds; 99% validated IOCs in ANY.RUN feeds.
• ANY.RUN 2026 data cited in the MSSP blog: email accounts for 30.3% of MSSP sandbox submissions.