Plans

Flexible plans for growth

Transparent pricing designed to fit your requirements.

Free
$0/month $0/month

Start exploring malware analysis with essential tools and limited dynamic sandboxing.

Start for Free
Environments
  • Windows 7 x64
  • Windows 10 x64
Researcher
$250 $199/month $250/month

Ideal for cybersecurity researchers who need deeper analysis tools and more flexibility.

Go with this plan
Environments
  • Windows 7 x64
  • Windows 10 x64
  • Windows 11 x64
  • MacOS
  • Android
  • Linux
Everything in the Free Plan, plus:
  • HTML Report
  • Re-Analyze Submission
  • Additional Files
  • Download Sample
  • Queue Priority
  • Export Submission
  • Private Submission
Hunter
$450 $399/month $450/month

Designed for threat hunters and analysts handling high volume and advanced scenarios.

Go with this plan
Environments
  • Windows 7 x64
  • Windows 10 x64
  • Windows 11 x64
  • MacOS
  • Android
  • Linux
Everything in the Researcher Plan, plus:
  • Custom VPN
  • PDF Report
  • STIX 2.1 Export
  • Commercial Usage
Promotions
Organization

Organization plan for teams of researchers and security operations teams.

Billing Yearly Save 18%
Per seat
$330 / month
Adjust seats (5–250)
Total / month (10 seats)
Billed yearly
Go with this plan
Environments
  • Windows 7 x64
  • Windows 10 x64
  • Windows 11 x64
  • MacOS
  • Android
  • Linux
Everything in Hunter, plus:
  • Centralized team billing & management
  • Role-based access controls
  • Shared workspace & sample library
  • Consolidated invoicing
  • MCP Support
Promotions
Enterprise

Built for scale

Dedicated infrastructure, custom service levels, and white-glove onboarding for larger teams.

Contact sales
Environments
  • Windows 7 x64
  • Windows 10 x64
  • Windows 11 x64
  • MacOS
  • Android
  • Linux
Everything in Hunter, plus:
  • Custom API call volume
  • MCP Support
  • Custom golden images & all targets
  • All file extensions & custom file sizes
  • Custom network configs (WireGuard, OpenVPN, proxy)
  • Private submissions & full report exports
  • Dedicated support + SSO
  • Volume licensing & custom SLAs
Promotions
Plan Comparison

Predictable pricing, designed to scale

Compare features to easily choose the plan that fits your team’s needs, whether you're starting small or scaling fast.

Select Plan
  • Free
  • Researcher
  • Hunter
  • Organization
  • Enterprises
Free

Perfect for hobby projects and experiments

$0/month $0/month

Start for Free
Researcher

Researcher Plan for Individual Researchers

$250 $199/month $250/month

Get Started
Hunter

Hunter Plan for Professional Malware Hunters

$450 $399/month $450/month

Get Started
Organization

Organization Plan for team of malware hunters

$400 $330/month (per seat) $400/month (per seat)

Get Started
Enterprises

Dedicated infrastructure, custom SLAs, and white-glove onboarding

Custom Custom

Contact Us
  • Size Maximum file size you can upload per submission. 16 MB 32 MB 650 MB 1 GB 4 GB
  • Extensions File types you can submit for analysis. All Extensions All Extensions All Extensions All Extensions All Extensions
  • API Limit Monthly request quota for the public API. 500 Custom
  • Concurrent Limit How many analyses can run at the same time. 1 1 1 1 Custom
  • Daily Limit How many submissions you can send per day. 50 250 500 500 Custom
  • Re-Analyze Submission Run a submission again with a different configuration or scan type — no need to re-upload.
  • Additional Files Download the artifacts an analysis produces: dropped files, memory dumps, and extracted payloads from dynamic, static, and emulation runs.
  • Download Sample Re-download the original submitted sample whenever you need it.
  • Html Report Download a self-contained HTML report summarizing the full analysis — verdict, indicators, and behavior — in one shareable file.
  • PDF Report Export polished PDF reports of your analysis results, ready to attach to tickets, cases, or incident reviews.
  • STIX 2.1 Report Export indicators and observables as a STIX 2.1 bundle that drops straight into your TIP, SIEM, or SOAR tooling.
  • Queue Priority While sending submissions, you will be in the upper priority level
  • Commercial Usage Use Threat.Zone results in your commercial products, services, and client work.
  • Export Submission Export any part of a submission — reports, network captures, and analysis data — file by file.
  • Private Submission Keep submissions visible only to you and your workspace — never listed publicly.
  • Custom VPN You will receive a custom OpenVPN configuration from us
  • Network Configs Route sandbox traffic through your own WireGuard, OpenVPN, or proxy configuration during dynamic analysis.
  • Start Arguments Launch samples with custom command-line arguments to reach code paths that only trigger with specific flags.
  • Pre-Script Run your own preparation script inside the sandbox before the sample executes — stage files, tweak settings, simulate a victim environment.
  • Run Command Execute your own commands inside the sandbox VM for hands-on investigation.
  • Scan Duration Extension Extend a running dynamic analysis on the fly when a sample needs more time to detonate.
  • MCP Support Connect Threat.Zone to AI agents, IDEs, and automation over the Model Context Protocol — included on every plan with API access.
Features Free $0/month $0/month Billed annuallyBilled monthly Start for Free Researcher $199/month $250/month Billed annuallyBilled monthly Get Started Hunter $399/month $450/month Billed annuallyBilled monthly Get Started Organization $330/month $400/month Billed annuallyBilled monthly Get Started Enterprises Custom Custom Billed annuallyBilled monthly Contact Us
Size Maximum file size you can upload per submission. 16 MB 32 MB 650 MB 1 GB 4 GB
Extensions File types you can submit for analysis. All Extensions All Extensions All Extensions All Extensions All Extensions
API Limit Monthly request quota for the public API. 500 Custom
Concurrent Limit How many analyses can run at the same time. 1 1 1 1 Custom
Daily Limit How many submissions you can send per day. 50 250 500 500 Custom
Re-Analyze Submission Run a submission again with a different configuration or scan type — no need to re-upload.
Additional Files Download the artifacts an analysis produces: dropped files, memory dumps, and extracted payloads from dynamic, static, and emulation runs.
Download Sample Re-download the original submitted sample whenever you need it.
Html Report Download a self-contained HTML report summarizing the full analysis — verdict, indicators, and behavior — in one shareable file.
PDF Report Export polished PDF reports of your analysis results, ready to attach to tickets, cases, or incident reviews.
STIX 2.1 Report Export indicators and observables as a STIX 2.1 bundle that drops straight into your TIP, SIEM, or SOAR tooling.
Queue Priority While sending submissions, you will be in the upper priority level
Commercial Usage Use Threat.Zone results in your commercial products, services, and client work.
Export Submission Export any part of a submission — reports, network captures, and analysis data — file by file.
Private Submission Keep submissions visible only to you and your workspace — never listed publicly.
Custom VPN You will receive a custom OpenVPN configuration from us
Network Configs Route sandbox traffic through your own WireGuard, OpenVPN, or proxy configuration during dynamic analysis.
Start Arguments Launch samples with custom command-line arguments to reach code paths that only trigger with specific flags.
Pre-Script Run your own preparation script inside the sandbox before the sample executes — stage files, tweak settings, simulate a victim environment.
Run Command Execute your own commands inside the sandbox VM for hands-on investigation.
Scan Duration Extension Extend a running dynamic analysis on the fly when a sample needs more time to detonate.
MCP Support Connect Threat.Zone to AI agents, IDEs, and automation over the Model Context Protocol — included on every plan with API access.