To ensure continued advanced threat detection and malware analysis coverage, Broadcom has recommended VMRay FinalVerdict as a strategic replacement. VMRay FinalVerdict is a modern, cloud-native malware analysis and sandboxing platform trusted by global enterprises and seamlessly integrates with your existing Symantec infrastructure.
VMRay’s agentless hypervisor-based technology defeats the most sophisticated sandbox-aware malware.
Accelerate SOC efficiency with fast, high-fidelity malicious/benign determinations and IOC extraction.
Drop-in replacement for Symantec's on-prem sandbox within Content Analysis to meet top security & compliance requirements.
Integrations with third-party threat intelligence feeds that is available upon request.
VMRay has worked with Broadcom to support a streamlined transition experience, including integration guidance, onboarding support, licensing transition options, proof-of-concept support and on-premise deployment.
Supports on-premise deployment requirements, secure software supply chain, and documentations federal teams need.
Runs directly inside secure environments. For on-premise use, a cloud authorization path such as FedRAMP is not required.
Supportes SBOMs, secure SDLC documentation, and EO 14028-related expectations for federal procurement process.
Provides agency-specific security assessments and internal authorization package preparations.
The honest answer is two-sided. First, the direction came from the vendor: Symantec, now Broadcom, chose not to invest further in the on-premises version of its malware analysis (MAA), which is now end-of-life. That left customers needing a path forward regardless of how the original technology performed.
Second, on the merits, VMRay is a stronger fit for today's threats. The Norman engine was genuinely pioneering in its era and earned its reputation, but malware analysis has moved on. VMRay's agentless, hypervisor-based approach holds up better against modern evasion techniques, produces higher-fidelity analysis, and keeps pace with current environments such as Windows 11.
Both are fair concerns, and we can speak to each directly.
On cost, we have calculated the total cost of ownership of VMRay versus MAA, and the two are on par — this is not a step up in spend.
On the learning curve, the day-to-day reality is simpler than people expect. The CAS-to-VMRay integration is a five-minute configuration task, and once it's in place, the process is fully identical to what customers had with MAA — nothing changes in their normal workflow. When someone does need to analyze a sample manually or dig into additional analysis detail, VMRay has an intuitive interface that's easy to navigate, so the learning curve is gentle. And where teams want extra support, we offer Professional Services to help them get up to speed.
Yes — Windows 11 support is a clear advantage of VMRay over the legacy MAA sandbox.
Not at all. Adjusting analysis profiles to enhance performance is done through the GUI and is fully documented, typically taking about five minutes. And if a team would rather have help, our Professional Services are available.
Why VMRay: VMRay leads on the technology that matters most for this use case. Its agentless, hypervisor-based analysis runs outside the guest with nothing for malware to detect, making it stronger at catching unknown and evasive threats than either alternative. The on-prem version is actively developed and kept at full parity with cloud, including support for current systems like Windows 11, and it supports golden images natively. That combination of detection depth, evasion resistance, and a maintained on-prem product is where VMRay separates itself.
Lastline: No longer available on-prem, and our existing integration was built and tested only against its cloud version — not a viable on-prem path.
Trellix / FireEye: The integration is unofficial and could stop working. It also risks the broader Broadcom relationship by potentially displacing CAS itself.
Yes — there is a migration document that walks customers through the process.
Importantly, this is not a lift-and-shift of the whole environment. Customers keep their existing Symantec stack: SWG/SMG and CAS all stay in place. VMRay replaces only the MAA sandbox piece — CAS simply sends detonation to VMRay instead of the retired on-prem sandbox, so the surrounding architecture is unchanged.
That means existing policies and rules carry over as-is, with no reconfiguration required. Customers continue with what they already have, and only the sandbox engine behind it changes.
Still have questions? Contact our sales or email us at broadcom@vmray.com.
