What’s Really Attacking Your Industry? Insights From 74K Sandbox Analyses

Reporting by Any.run BlogRead the original at any.run

Executive Summary

Security teams analyze suspicious files and links daily using ANY.RUN, generating data on emerging threats and operational performance across various sectors like banking and retail. Real-world investigations show that threat data reveals which submissions are most likely malicious and how quickly threats are detected, providing context beyond individual verdicts. By comparing organizational findings with industry benchmarks, security leaders can identify differences in threat exposure and prioritize security efforts. For a financial organization studied, the analysis of 74,086 sandbox results indicated that while the malicious yield was similar to the banking median, file types like PowerShell scripts and MSI installers showed significantly higher malicious yields than URL-based samples. Furthermore, the organization achieved a median time to detection of 15.1 seconds, slightly faster than the sector median of 16.9 seconds, indicating efficient threat identification.

Facts Only

* Thousands of SOC and IR teams analyze suspicious files, emails, and links with ANY.RUN daily.
* The analysis generates data on emerging threats, industry trends, and SOC operational performance.
* 74,086 Sandbox analyses were examined from one financial organization over one quarter.
* Files accounted for 39.5% of submissions, and URLs accounted for 60.5%.
* The total malicious yield across analyzed samples was 12.8%.
* PowerShell scripts had an 88.2% malicious yield, followed by MSI installers at 75.2% and Outlook email files at 71.5%.
* Executables had a 70.5% malicious yield, and Android APK files had a 59.3% malicious yield.
* The median time to detection for the organization was 15.1 seconds, compared to an industry median of 16.9 seconds.
* Nineteen unique malware families were observed, placing the organization in the top 1% of banking-sector peers for family diversity.
* For the financial organization, 74.8% of analyzed threats were malicious code, and 25.2% were phishing.

Full Take

The value proposition shifts from mere detection to contextualized intelligence. The data demonstrates a critical gap between observing individual threat verdicts and understanding systemic risk within an industry. Organizations rely on sector benchmarks for context, but true defense requires integrating proprietary findings with external knowledge to calibrate response priorities. The finding that file format is more predictive of maliciousness than the source itself—with ZIP archives showing over 50% malicious yield—suggests that relying solely on superficial indicators fails operational teams. This creates a tension between generalized industry intelligence and specific organizational exposure, which can lead to misallocation of resources if context is ignored. The underlying pattern suggests that centralized threat intelligence, when applied contextually, shifts the focus from reactive investigation to proactive risk modeling across the entire security lifecycle. What happens when organizations prioritize the analysis of less-seen threat vectors simply because they exist in the aggregate data, rather than focusing solely on immediate surface threats?
BRIDGE QUESTIONS: If industry benchmarks accurately reflect typical exposure, why do organization-specific findings show such significant divergences regarding malware composition? How should SOC leaders architect workflows to seamlessly integrate dynamic, multi-source threat intelligence while maintaining operational velocity? What are the long-term consequences of relying on generalized threat prevalence versus granular internal exposure in resource planning?

From the original · Any.run Blog

Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance.

Read the full story at any.run

Sentinel — Human

Confidence

The text exhibits high structural coherence and depth typical of detailed analysis, strongly suggesting it was written by an analyst or journalist synthesizing specific, real-world security data, rather than being purely synthetic content.

Signals Detected

Text is highly structured and flows logically from specific data points to broader implications, suggesting intentional narrative construction.

Variations in sentence structure are present, particularly in the tabulated data integration, which counters a purely metronomic rhythm.

The consistent use of internal benchmarks and explicit data presentation (tables) points toward structured reporting rather than raw generation.

Specific numbers (e.g., 74,086 analyses, 12.8% malicious yield, MTTD times) are presented as derived from a specific study context, which suggests grounding in real or simulated data, although the source is aggregated.

Human Indicators

The integration of highly specific comparative statistics and structured table formats requires careful synthesis, often characteristic of human editorial work synthesizing proprietary data.

The nuanced distinction between industry averages and organization-specific findings shows an analytical progression beyond simple data regurgitation.