ITogether

OPSWAT MetaDefender

OPSWAT's MD-Core consists of Multiscannng, Deep CDR, Filescan (Sandbox), DLP, File Based Vulnerability, Software Supply Chain for the protection against malware threats. OPSWAT has complimentary products and features such as Managed File Transfer (aka Vault), Diode Technology (CDS, IDG), and an umber of Access and IOT Solutions.

Features

• Multi AV scanning of files up to 33 AV vendors
• Deep Content Disarm and Reconstruction of a file
• DLP - Detect and Block sensitive data in files
• File Based vulnerability - detect application vulnerabilities before installing
• Software SupplyChain - visibility & defence against supply chain risks
• API first architecture for seamless integration into modern applications
• Removable media scanning and policy enforcement at the edge
• File reputation analysis using global threat intelligence
• Secure file transfer and scanning for MFT and upload workflows
• Software supply chain scanning for repositories and build pipelines

Benefits

• Identify and block 99.6%+ of the Top 10000 Treats
• Deweaponise 180+ FileTypes so zerodays can't execute
• Use a multilayered approach to gain certainty files are malwarefree
• Use DLP to redact words, remove data from certain filestypes
• DLP control egress of files from an organisation or tier
• Use OPSWAT's intelligence to block certain File's types on reputation
• MetaDefender Core to cleanse files presented in variety of ways
• ICAP, API, Directly Connected, Files at Rest, MFT or RemoveableMedia
• Scan Repo's and analyse for Malware in Software Supply Chain
• Use OPSWAT's Vault to Encrypt and hold Files post scan

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@itogether.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

786049570123919

Contact

Tim Ripper
01133410123
sales@itogether.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  • Endpoint security
  • Security analytics
  • Governance, risk and compliance

  Identity and access management

  • Access

  Network security

  • Trusted network access and protection
  • Active application security

  Data security

  • Information protection
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
• Service constraints: N/A
• System requirements:
  • Deployed on Linux or Windows server environments
  • Supports on premises, virtualised, and cloud based deployments
  • Storage sized based on file volume and retention requirements

User support

• Email or online ticketing support: Yes
• Support response times: Priority Level - Maximum Response Time Target P1 – Major Impact - 1 Hour P2 – Moderate Impact - 4 Hours P3 – Low Impact - 6 Hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Remote Support: 8x5 - £500 per month <50 users, £750 per month <100 users, £1000 per month <250 users, £1500 per month >250 users. 24x7 - £750 per month <50 users, £1000 per month <100 users, £1250 per month <250 users, £2000 per month >250 users. Both a dedicated Account Manager and access to the support team are included in the above costs. Support includes: - Rule based changes - Configuration changes - User creation and deletion - Software updates and management *critical patching and minor OS configuration changes / updates. - Guaranteed SLAs - Quarterly Service Review All prices are ex VAT
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The OPSWAT onboarding process begins with a comprehensive setup of your security solution tailored to your infrastructure. It includes installation, configuration of security policies, and initial training sessions. OPSWAT’s support team ensures smooth integration and provides ongoing assistance to optimise your system’s performance and security.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: MetaDefender Cloud processes files for security inspection and does not store customer content beyond processing. As a result, there is no customer data to extract when the contract ends.
• End-of-contract process: At the end of an OPSWAT contract, the subscription is deactivated and access to licensed features is withdrawn. Management console and API access are disabled once the term expires. Customers are expected to export logs, reports, and configuration data before expiry. Scan engines and integrations stop processing new files or devices. Data is retained for a limited period in line with OPSWAT retention policies, after which it may be securely deleted.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Our service is B2B and currently is not tested according to EN 301 549 accessibility standards.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The OPSWAT service interface is typically delivered via the MetaDefender web-based management console, giving admins a central dashboard for system status and recent activity. From the UI, teams configure policies and workflow rules (processing profiles), manage scan engines and integrations, and monitor results and alerts. In OT and removable-media use cases, MetaDefender Kiosk provides a locked-down, touch-friendly user interface for scanning, with a separate management console for administration.
• Accessibility standards: None or don’t know
• Description of accessibility: Our service is B2B and currently is not tested according to EN 301 549 accessibility standards.
• Accessibility testing: Our service is B2B and currently is not tested according to EN 301 549 accessibility standards.
• API: Yes
• What users can and can't do using the API: Users configure MetaDefender Cloud via REST APIs to onboard integrations, update policies, and manage workflows. Configuration is API driven with predefined parameters and permissions limiting unsupported changes.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Users integrate, configure scanning behaviours, workflows, and protections via REST APIs, and tailor file scanning, sanitisation, DLP, and reputation controls to fit their cloud workflows and security policies.

Scaling

• Independence of resources: MetaDefender Cloud uses scalable, multi tenant cloud architecture with elastic capacity, workload isolation, and regional deployment to ensure individual customers are not impacted by other users’ demand.

Analytics

• Service usage metrics: Yes
• Metrics types: MetaDefender Cloud provides service usage metrics including scan volumes, file verdicts, threat detections, sanitisation actions, and processing status. Metrics are available through the web dashboard and APIs for reporting and monitoring.
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: OPSWAT

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Other
• Other data at rest protection approach: MetaDefender services do not import user datasets in the traditional sense. Instead, they accept files for security inspection. Users can upload and submit a wide range of open and proprietary file formats, with support for 180+ file types, via API, ICAP, uploads, repositories, MFT, or removable media.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: MetaDefender Cloud processes files for security inspection and does not store customer content beyond processing. As a result, there is no customer data to extract when the contract ends.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability commitments for MetaDefender Cloud are defined contractually. Any remedies, such as service credits, are agreed with customers as part of commercial terms rather than published standard SLAs.
• Approach to resilience: MetaDefender Cloud is designed for resilience using cloud native architecture, regional deployment, redundancy, automated scaling, continuous monitoring, and fault tolerant components to maintain service availability during demand spikes or infrastructure failures.
• Outage reporting: Outages are published online at https://trust.opswat.com/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Only admins with the pre-authorised access can access dashboards and tooling controls.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials
• Information security policies and processes: ISO27001:2022 plus we are Cyber Essentials certified and ITogether has our own Information Security Policy which can be provided upon request. This includes the reporting structure for any incidents.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: OPSWAT follows formal configuration and change management processes aligned with ISO/IEC 27001. These include controlled change approval, version management, testing prior to release, audit logging, and documented rollback procedures, as described on opswat.com.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: OPSWAT manages vulnerabilities through continuous monitoring, regular internal and external testing, timely patching, risk based prioritisation, and independent audits, aligned with ISO/IEC 27001 and documented on opswat.com.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: OPSWAT uses continuous protective monitoring to identify potential compromises through logging, alerting, threat intelligence, and security monitoring controls. When a potential compromise is detected, incidents are investigated and contained using defined incident response procedures. Response times are prioritised based on risk and severity, with timely remediation actions taken in line with OPSWAT’s security governance and incident management processes documented on opswat.com.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: OPSWAT follows predefined incident management processes aligned with its security governance framework. Common incident scenarios are documented and handled through established response procedures. Users report incidents via OPSWAT support channels, and incident reports are provided to affected customers as appropriate, including impact, actions taken, and remediation outcomes, in line with OPSWAT’s policies documented on opswat.com.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Friday 10 October 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 6a64b996-921c-4efd-b13f-370786a8e974
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Ensuring new workers are informed of their right to join a trade union
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@itogether.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.