VMRay

VMRay has extended its detonation-based sandbox from pure malware analysis into phishing analysis and government-channel distribution via Carahsoft, a steady cadence of expansion for a specialist platform rather than a fast-moving new entrant.

Hypervisor-level introspection is a technically substantive capability: monitoring execution from below the guest OS avoids installing an in-guest agent that malware can fingerprint, a real architectural advantage over many agent-based sandboxes.

Two Series B rounds closed within about a month of each other (Tikehau Ace Capital in December 2022, Digital+ Partners in January 2023) show recent, real investor interest, though reported total funding figures vary across press sources.

Agentless, hypervisor-based monitoring is a genuine technical departure from the in-guest-agent design most competing sandboxes rely on, directly addressing a known sandbox-evasion weakness rather than iterating on the same approach.

No independent third-party evaluation (e.g., MITRE-style testing) of VMRay's detection or evasion-resistance claims was found; the available evidence is vendor and funding-round press describing customers as "some of the world's most valuable corporations" without named case studies.

Automated malware and phishing triage remains a core SOC and threat-intel workflow, and VMRay's MSSP-focused packaging fits the growing trend of security teams outsourcing detection engineering to managed providers.