Anomali vs VirusTotal comparison

Anomali and VirusTotal are both solutions in the Threat Intelligence Platforms (TIP) category. Anomali is ranked #7 with an average rating of 8.5, while VirusTotal is ranked #5 with an average rating of 8.8. Anomali holds a 3.9% mindshare in TIPT, compared to VirusTotal’s 3.5% mindshare. Additionally, 80% of Anomali users are willing to recommend the solution, compared to 100% of VirusTotal users who would recommend it.

Anomali

Read 4 Anomali reviews

4,409 Views
1,852 Comparison Views

80% willing to recommend

VirusTotal

Read 11 VirusTotal reviews

5,486 Views
2,469 Comparison Views

100% willing to recommend

Anomali

VirusTotal

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 18, 2026

Anomali and VirusTotal are competing in the cybersecurity solutions category. Anomali has the upper hand in advanced threat intelligence capabilities, while VirusTotal is preferred for its comprehensive malware detection and analysis.

Features: Anomali offers advanced threat intelligence capabilities, deep insights, and extensive integration within IT ecosystems. VirusTotal provides robust malware detection, comprehensive file analysis, and integration with more than 70 antivirus engines.

Room for Improvement: Anomali's pricing and support have been concerns, and its initial setup can be complex. VirusTotal could benefit from deeper integration options, more strategic insights for long-term threat prevention, and improved customization for specific business needs.

Ease of Deployment and Customer Service: Anomali requires a complex setup with ongoing integration but benefits large enterprises. VirusTotal's web-based model enables quick deployment, although it may lack Anomali's depth of integration, relying more on a streamlined approach.

Pricing and ROI: Anomali involves higher initial setup costs with the promise of significant ROI through strategic intelligence. VirusTotal offers a cost-effective entry point with immediate detection benefits but less focus on long-term strategic ROI.

To learn more, read our detailed Anomali vs. VirusTotal Report (Updated: March 2026).

Buyer's Guide

Anomali vs. VirusTotal

March 2026

Download the complete report

Helped 886,011 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Anomali

Ranking in Threat Intelligence Platforms (TIP)

7th

Average Rating

7.8

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (32nd), User Entity Behavior Analytics (UEBA) (12th), Advanced Threat Protection (ATP) (20th), Extended Detection and Response (XDR) (23rd)

VirusTotal

Ranking in Threat Intelligence Platforms (TIP)

5th

Average Rating

8.8

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

Anti-Malware Tools (4th)

Mindshare comparison

As of April 2026, in the Threat Intelligence Platforms (TIP) category, the mindshare of Anomali is 3.9%, down from 5.4% compared to the previous year. The mindshare of VirusTotal is 3.5%, down from 5.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Threat Intelligence Platforms (TIP) Mindshare Distribution
Product	Mindshare (%)
VirusTotal	3.5%
Anomali	3.9%
Other	92.6%

Threat Intelligence Platforms (TIP)

Featured Reviews

ChrisCollins

Enterprise Security Architect V at FirstEnergy

Enables automated threat intelligence sorting and enhances proactive threat hunting capabilities

You have to have at least a threat intelligence background or a SOC analyst background to use it, as that's the information you'll dig around with in there. If you don't have that kind of knowledge, it probably can be a little hard to use, but they do provide training. They offer training not only for how to use the platform but also some basic threat intelligence training to explain what these things are and what these terms mean. My company is a customer of Anomali. I would recommend it to other people. I would advise making sure you don't pick it without testing other products and have your use cases well thought out and documented before testing, so you know it will solve the problems you're trying to address. Keep an open mind with it and realize that whatever you can dream of, you can probably do with the platform. Overall, I would rate Anomali an eight out of ten.

Read full review

Chinmay Banerjee

Advisor Adtech/Martech/API product/project Engineering at a financial services firm with 10,001+ employees

Helps businesses collect threat data while keeping privacy in mind and apable of detecting, blocking, and removing viruses and malware

There are two gray areas I still need to explore. I have worked with VirusTotal because it easily integrates with over seventy antivirus scanners and blacklisting services. In addition to those there is much scope to improve and add other services or integrations. The areas for improvement are that VirusTotal is not using much AI or generative AI models, while other competitors are starting to build them. For example, VirusTotal's work is based on the setup done by their engineers. If you want to do scanning or protection activities for a specific site, app, or device, that is the area VirusTotal is currently focused on. But other competitors are building AI models that can do things like left-side scanning and provide auto-generated reports. VirusTotal has predefined reports, but there is a lot of manual effort involved. Secondly, the API is very limited if I want to integrate VirusTotal with other applications. They need to build more connectors and provide support for Webhook connectors for the API. If you can't build your own connector, it's always good to have provisions for Webhook setup connectors across platforms. Thirdly, Kaspersky, a competitor of VirusTotal, is using a methodology called "gatekeeper." A gatekeeper is a security system that protects the inside of a building from outside threats. This is the model Kaspersky is currently using. You have your website set up, but the entire army of VirusTotal or Kaspersky is standing guard, protecting you from the first gate itself. Right now, VirusTotal detects threats from your domain, but it is always better to verify inside the domain and protect it from the first level when people or malware are entering. This first level of protection is lacking in VirusTotal right now. The security bridge and protection gate are missing.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The feature I have found most valuable is credential monitoring. This feature is easy and quick."

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"We now have a very robust collection of threat intelligence based on the capabilities that Anomali provides."

"The most valuable aspect of Anomali is the threat modeling capability."

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"It gives detailed information about suspicious IPs, which is one of its most valuable features."

"It is quite simple for anyone if they just want to check some suspicious URLs."

"VirusTotal provides 95% to 98% accurate information."

"It allows us to see if there have been previous reports on certain indicators of compromise, providing insights from other security professionals."

"The initial setup is easy."

"It can scan the dark web and find if an email ID has been compromised. This is another area that we have not explored yet."

"With VirusTotal, I can check for any hash, malware, file, domain, IP URL, or malicious URL, and Kaspersky stays clean."

"It provides detailed insights into possible malicious behavior, dropped files, and TCP connections."

More VirusTotal pros

Cons

"Less code in integration would be nice when building blocks."

"Support in the past has been top-notch, but recent trends indicate that it has taken a back seat, as we often don't get answers for days."

"A lot of tools can give you many features, such as CTI intelligence and a tax service reduction. However, many people are combining different tools together to have more capabilities. It is up to the consumer whether they want to have multiple tools or have one tool that serves the purpose. Anomali Enterprise could improve by combining all the other tools' features into one solution."

"Anomali Enterprise could improve by combining all the other tools' features into one solution."

"An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting."

"VirusTotal is hard to understand because you need to know Google Docs to create queries, and it doesn't have documentation for that."

"I would like to see an improved user interface and some automation."

"VirusTotal has different versions, and sometimes the parameters of the API are not very clear."

"The platform could improve in the areas of endpoints and networks."

"There should be room for improvement, particularly in the API side of things."

"They can improve the telemetry. Whenever we handle a sample, they cannot provide any information about a victim."

"I would like to see improved correlation with other threat intelligence sources, not just reliant on its own database, to enhance the database of threat intelligence that VirusTotal offers."

"I would like to see improvements in the score consistency and accuracy."

More VirusTotal cons

Pricing and Cost Advice

"When comparing the price of Anomali Enterprise to other solutions it is in the medium to high range. However, I am satisfied with the price."

"The pricing is reasonable."

"We are using VirusTotal with free licenses, managing the license limits across three or four accounts, thus incurring no costs."

"The pricing is very economical."

"VirusTotal is an expensive solution."

See which vendors are best for you

Use our free recommendation engine to learn which Threat Intelligence Platforms (TIP) solutions are best for your needs.

See recommendations

886,011 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Construction Company

Manufacturing Company

Computer Software Company

13%

Financial Services Firm

11%

Comms Service Provider

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	2
Midsize Enterprise	1
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	4
Midsize Enterprise	2
Large Enterprise	5

Questions from the Community

What needs improvement with Anomali ThreatStream?

An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting. Combining all aliases ...

See all answers

What is your primary use case for Anomali ThreatStream?

I use Anomali ( /products/anomali-reviews ) for threat hunting, threat collection, operationalization of intelligence, such as indicators of compromise (IOCs), and dissemination of reports for repo...

See all answers

What advice do you have for others considering Anomali ThreatStream?

For new users, I recommend taking the training provided by Anomali as it is very well articulated. I advise reading the user manual and taking the instructor-led training sessions from the customer...

See all answers

What is your experience regarding pricing and costs for VirusTotal?

I do not know about the pricing or licensing as our organization services VirusTotal for our clients.

See all answers

What needs improvement with VirusTotal?

I would like to see improvements in the score consistency and accuracy. VirusTotal should add more details like those from competitors such as URL Void or Symantec URL Checker, which show the categ...

See all answers

What is your primary use case for VirusTotal?

As I work in an incident response role, my daily task is to mitigate the security alert and perform the analysis part. When any alerts come, I check the IPs from where they originate and the locati...

See all answers

Comparisons

ThreatConnect Threat Intelligence Platform (TIP) vs Anomali

Compared 5% of the time

Recorded Future vs Anomali

Compared 5% of the time

Splunk Enterprise Security vs Anomali

Compared 4% of the time

IBM Security QRadar vs Anomali

Compared 3% of the time

Hunters vs Anomali

Compared 3% of the time

More Anomali Competitors

MetaDefender vs VirusTotal

Compared 10% of the time

OPSWAT Filescan Sandbox vs VirusTotal

Compared 9% of the time

ANY.RUN vs VirusTotal

Compared 6% of the time

Microsoft Defender for Endpoint vs VirusTotal

Compared 5% of the time

ReversingLabs vs VirusTotal

Compared 4% of the time

More VirusTotal Competitors

Product Reports

Buyer's Guide

Threat Intelligence Platforms (TIP)

March 2026

Download Anomali product report

Buyer's Guide

Anti-Malware Tools

April 2026

Download VirusTotal product report

Also Known As

Match, Lens, ThreatStream, STAXX, Anomali Security Analytics

No data available

Overview

Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.

Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.

What are Anomali's Key Features?

Threat Intelligence: Provides concise and user-friendly intelligence.
Threat Modeling: Enables prioritization and efficient organization of intelligence.
Credential Monitoring: Performs quickly with efficient dataset handling.
API Automation: Supports large-scale automation for robust intelligence management.
Adaptability: Offers capabilities to grow beyond initial use cases.

Which Benefits or ROI Should Users Consider?

Efficient Intelligence Collection: Quickly gathers and organizes data for use.
Enhanced Threat Analysis: Correlates data effectively for proactive security.
Automation Support: Saves time with extensive API capabilities.
Scalability: Adapts and scales with emerging security needs.

Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.

Anomali

VirusTotal provides a comprehensive digital security platform by leveraging a vast malware database. It integrates numerous antivirus scanners for robust malware and virus detection, offering valuable insights for threat intelligence and security analysis.

VirusTotal is widely used for malware analysis and cybersecurity investigations, relying on its extensive capabilities in file and IP analysis. It integrates seamlessly with various antivirus engines, ensuring detailed threat intelligence. The platform excels at performing automated reputation checks, gleaning insights from a robust community, and delivering comprehensive information on suspicious activities. With an API system, it facilitates deeper analysis and integration into existing security workflows.

What are the standout features of VirusTotal?

Vast Malware Database: A comprehensive repository for malware intelligence.
Integration with Antivirus Scanners: Collaborates with multiple scanners for enhanced detection.
File and IP Analysis: Detailed insights into files and IP addresses.
Automated Reputation Checks: Efficiently verifies file and domain safety.
Community Insights: Gathers valuable data from an active community.

What benefits and ROI should be considered?

Threat Intelligence: Informs strategic security decisions with detailed malware data.
Enhanced Detection: Supports comprehensive threat identification and response.
Contextual Analysis: Provides extensive details for thorough investigation of threats.

In sectors like retail, FinTech, and GRC, VirusTotal is integrated into cybersecurity workflows to enhance incident response capabilities. It is invaluable for analyzing phishing websites, inspecting URLs, identifying compromised information, and generating alerts for specific threats. APIs enable deeper examination of suspicious activity, supporting comprehensive cybersecurity operations.

VirusTotal

Sample Customers

Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network

Information Not Available

Buyer's Guide

Anomali vs. VirusTotal

March 2026

Free Report: Anomali vs. VirusTotal

Find out what your peers are saying about Anomali vs. VirusTotal and other solutions. Updated: March 2026.

DOWNLOAD NOW

886,011 professionals have used our research since 2012.

See our Anomali vs. VirusTotal report.

See our list of best Threat Intelligence Platforms (TIP) vendors.

We monitor all Threat Intelligence Platforms (TIP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.