Retrace
Retrace: A flexible sandbox combining VM telemetry, collaboration, and self-hosted deployment. Ranked #11 of 26 in Malware Analysis Sandboxes by our editors (8.3/10); pricing: Free plan; best for teams wanting free analysis with self-hosting options.
At a glance
- Editor score8.3 / 10
- PricingFree plan
- Best forTeams wanting free analysis with self-hosting options
- Free planYes
- URL analysisYes
- Facts checked20 Sep 2026
Where it wins
- Free Community plan with unlimited public analyses
- Detailed VM telemetry with ATT&CK tags and threat verdicts
- Cloud, API, and self-hosted deployment options
Where it doesn't
- Private submissions begin with the Team tier
- Paid plans use Contact or Custom pricing
- Advanced sovereignty features require higher tiers
Our verdict on Retrace
Retrace is a malware analysis sandbox for security researchers, incident responders, threat intelligence teams, consultants, and security operations groups. It runs suspicious samples in isolated virtual machines and provides process, file, registry, DNS, and network telemetry. Analysts can review activity through a web interface, monitor virtual machines in real time through VNC, inspect screenshot timelines, and receive behavioral reports, threat scores, verdicts, and MITRE ATT&CK tagging. AI-generated summaries, collaboration tools, REST API access, and Markdown, PDF, and STIX 2.1 exports extend it beyond a basic detonation environment.
The plan structure separates public analysis from private and controlled workflows. Community includes community feed access, a standard execution queue, the web interface, basic report export, and unlimited public analyses. Team adds private submissions, priority queueing, REST API access, team management, and audit logging. Enterprise adds multi-tenant workspaces, dedicated hardware, SSO / SAML, custom data retention, and UK, EU, or US data residency on request. Sovereign is aimed at air-gapped operations, with unlimited throughput, full data sovereignty, custom hardware support, and a dedicated account manager. Paid tiers use Contact or Custom pricing.
Deployment flexibility is a central consideration. Retrace supports web access, API workflows, cloud deployment, and on-premises operation, while MISP and TIP integrations connect analysis with threat intelligence processes. The Enterprise and Sovereign tiers are the relevant choices for organizations needing dedicated infrastructure, data residency, or air-gap compatibility. Teams focused on public research can start with Community, while organizations requiring private submissions, governance, or controlled environments should evaluate Team, Enterprise, or Sovereign. Retrace is less suited to buyers seeking a simple analysis interface without tier-based collaboration and deployment controls.
Questions about Retrace
What does Retrace run on? Web. It runs in the cloud and self-hosted.
What does Retrace integrate with? 2 integrations: MISP and TIP.
Who is Retrace built for? Solo users, small businesses, mid-market companies and enterprises (our editorial estimate).
Your product? Our editors can test Retrace in depth and publish a review, labelled as paid · from $149/mo →
Retrace pricing
All 4 Retrace plans and prices →
Retrace fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| URL analysis | Yes |
| API access | Yes |
| Network traffic analysis | Yes |
| IOC extraction | Yes |
| File size limit | Not verified |
| Result retention | Not verified |
| Deployment model | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Compliance & security | GDPR, SSO/SAML |
| Support | Email, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: MISP, TIP |
| Pricing | Free plan (source) |
| Website | retrace.cloud |
| Facts checked | 20 Sep 2026 |
Retrace integrations
Retrace lists 2 integrations on its own site.
- MISP
- TIP
Alternatives to Retrace
- ANY.RUNInteractive browser-based analysis with strong SOC integrations and team controls.9.4
- Joe SandboxA broad sandbox for analysts who need deep evidence, IOC reporting, and flexible exports.9.3
- CAPE SandboxA broad, self-hosted sandbox for dynamic analysis, extraction, debugging, and network evidence.9.1
See all Retrace alternatives →
Used Retrace? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Retrace for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Retrace is listed in our Malware Analysis Sandboxes directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/retrace/"><img src="https://www.itechguides.com/best/badge/retrace.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update