Retrace review
A flexible sandbox combining VM telemetry, collaboration, and self-hosted deployment.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Retrace is a malware analysis sandbox for security researchers, incident responders, threat intelligence teams, consultants, and security operations groups. It runs suspicious samples in isolated virtual machines and provides process, file, registry, DNS, and network telemetry. Analysts can review activity through a web interface, monitor virtual machines in real time through VNC, inspect screenshot timelines, and receive behavioral reports, threat scores, verdicts, and MITRE ATT&CK tagging. AI-generated summaries, collaboration tools, REST API access, and Markdown, PDF, and STIX 2.1 exports extend it beyond a basic detonation environment.
The plan structure separates public analysis from private and controlled workflows. Community includes community feed access, a standard execution queue, the web interface, basic report export, and unlimited public analyses. Team adds private submissions, priority queueing, REST API access, team management, and audit logging. Enterprise adds multi-tenant workspaces, dedicated hardware, SSO / SAML, custom data retention, and UK, EU, or US data residency on request. Sovereign is aimed at air-gapped operations, with unlimited throughput, full data sovereignty, custom hardware support, and a dedicated account manager. Paid tiers use Contact or Custom pricing.
Deployment flexibility is a central consideration. Retrace supports web access, API workflows, cloud deployment, and on-premises operation, while MISP and TIP integrations connect analysis with threat intelligence processes. The Enterprise and Sovereign tiers are the relevant choices for organizations needing dedicated infrastructure, data residency, or air-gap compatibility. Teams focused on public research can start with Community, while organizations requiring private submissions, governance, or controlled environments should evaluate Team, Enterprise, or Sovereign. Retrace is less suited to buyers seeking a simple analysis interface without tier-based collaboration and deployment controls.
Questions about Retrace
What does Retrace run on? Web. It runs in the cloud and self-hosted.
What does Retrace integrate with? 2 integrations: MISP and TIP.
Who is Retrace built for? Solo users, small businesses, mid-market companies and enterprises (our editorial estimate).
Retrace pros and cons
- Where it wins
- Free Community plan with unlimited public analyses
- Detailed VM telemetry with ATT&CK tags and threat verdicts
- Cloud, API, and self-hosted deployment options
- Where it doesn't
- Private submissions begin with the Team tier
- Paid plans use Contact or Custom pricing
- Advanced sovereignty features require higher tiers
Retrace fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update