Sandbox Resource Calculator

concurrentVMs = samplesPerDay ÷ (1440 ÷ (runtime + resetTime) × utilisation); physicalCores = concurrentVMs × vCPU ÷ overcommitRatio. Each VM completes 1440 minutes of day divided by its cycle time, where the cycle is the detonation window plus the snapshot revert — reverting is not free and on a five-minute runtime it is a fifth of the cost. Divide the daily sample volume by realistic per-VM throughput to get concurrency, then convert to hardware using your vCPU overcommit ratio. Memory does not overcommit safely for malware analysis, so RAM usually sets the host count.

Sandbox farms are sized on peak submission, not average: an incident that dumps ten thousand samples into the queue is exactly when analysts cannot wait six hours for a verdict.

This calculator takes 9 inputs: Samples to detonate per day, Detonation runtime per sample, Snapshot revert and setup per run, vCPU per analysis VM, RAM per analysis VM, Artefacts retained per sample, Artefact retention, vCPU overcommit ratio, Target farm utilisation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because ballooning and swapping change timing, and timing changes malware behaviour — some samples explicitly check for it. Overcommitted memory also risks a detonation being paged out mid-run, which produces a useless report.

No. Most commodity malware reveals its behaviour in the first two to three minutes, and doubling the runtime halves farm throughput. Reserve long runs for samples that show sleep or trigger-based evasion in the short run.