Edition access

Complete current-build feature comparison.

A check means the feature is available in that edition. A dash means it is locked or unavailable. Help Center content is visible across editions so evaluators can understand paid capabilities without bypassing license controls.

View pricing Product Guide

Edition access

Complete current-build feature comparison.

Free

Core investigation

Threat Lookup, Rapid Scan, Deep Signature Scan, Quarantine Vault review, Reports & Evidence, Detection Library, Threat Briefing, Vulnerability Alerts, and Help Center.

Professional

Analyst workstation

Everything in Free plus Zero-Day Analysis, Threat Intelligence, licensed connectors, Dark Web Intelligence, custom feeds, Live Protection, and Ransomware Shield.

Professional and Enterprise include custom Intelligence query templates and Threat Briefing/CVE watchlists.

Automated Unpacker — Experimental controlled unpacking and protected evidence

Enterprise

Private and deep analysis

Everything in Professional plus Administration, private packages, MIVault (Experimental), App Lock, Security Connectors, Startup & Persistence Manager, selected-process Process Memory Capture and Payload & Memory Analyzer, and API/DLL trace workflows.

API Hook Trace — Enterprise Developer Preview, AlertOnly evidence

Feature	Free	Professional	Enterprise
Threat Lookup and reputation review	✓Yes	✓Yes	✓Yes
Rapid Scan — known-bad hash evidence	✓Yes	✓Yes	✓Yes
Deep Signature Scan — HEX signatures	✓Yes	✓Yes	✓Yes
YARA rule scan	✓Yes	✓Yes	✓Yes
Quarantine Vault review, restore, delete, export	✓Yes	✓Yes	✓Yes
Reports & Evidence	✓Yes	✓Yes	✓Yes
Detection Library	✓Yes	✓Yes	✓Yes
Threat Briefing reader and PDF export	✓Yes	✓Yes	✓Yes
Vulnerability Alerts reader and PDF export	✓Yes	✓Yes	✓Yes
Zero-Day Analysis	—No	✓Yes	✓Yes
Threat Intelligence	—No	✓Yes	✓Yes
Custom VirusTotal API key	—No	✓Yes	✓Yes
Built-in Intelligence query templates	—No	✓Yes	✓Yes
API Explorer	—No	✓Yes	✓Yes
Malware download when account allows it	—No	✓Yes	✓Yes
Custom Threat Briefing RSS/Atom feeds	—No	✓Yes	✓Yes
Organization-owned licensed Threat/CVE API connectors	—No	✓Yes	✓Yes
Dark Web Intelligence through a licensed provider	—No	✓Yes	✓Yes
Protection Matrix / Live Protection — File / Registry / Process / Network / Security Timeline	—No	✓Yes	✓Yes
Ransomware Shield	—No	✓Yes	✓Yes
Automated Unpacker — Experimental controlled unpacking and protected evidence	—No	✓Yes	✓Yes
Crypto Lab — Offline config and key analysis	—No	✓Yes	✓Yes
Portal installer download	—No	✓Yes	✓Yes
Startup & Persistence Manager — Registry Run, Startup Folder, and Scheduled Task restore-ready cleanup	—No	—No	✓Yes
Process Memory Capture — six x86/x64 dump formats, exact 1 GiB per artifact	—No	—No	✓Yes
Payload & Memory Analyzer — supported EXE/DLL/SYS, MSI and legacy Office .doc file analysis	—No	—No	✓Yes
Payload & Memory Analyzer — supported .memimg/.dmp memory-artifact analysis	—No	—No	✓Yes
Guided API Trace — Selected-process correlation without debugger breakpoint interception	—No	—No	✓Yes
Deep API Trace — Native API observation for a running process	—No	—No	✓Yes
API Hook Trace — Inline API observation for a controlled EXE	—No	—No	✓Yes
DLL Behavior Trace — controlled native x86/x64 DLL observation	—No	—No	✓Yes
MIVault — portable encrypted analyst evidence	—No	—No	✓Yes
Final Report to CISO	—No	—No	✓Yes
Security Connectors — SIEM/XDR/SOAR/gateway events	—No	—No	✓Yes
App Lock — password-protected access and tray/exit actions, with Enterprise-license recovery	—No	—No	✓Yes
Local Update server	—No	—No	✓Yes
Private encrypted hash/signature/YARA packages — usable even when standard Hash/Signature/YARA scanning is disabled	—No	—No	✓Yes
Offline Windows Memory Forensics — in-development advertisement / Developer preview only	—Not generally available	—Not generally available	—Not generally available