Skip to content
ENExplore Calculators

Sandbox Resource Calculator

Size a malware analysis sandbox farm: concurrent VMs, CPU, RAM, storage and daily sample throughput per node.

About Sandbox Resource Calculator

Each VM completes 1440 minutes of day divided by its cycle time, where the cycle is the detonation window plus the snapshot revert — reverting is not free and on a five-minute runtime it is a fifth of the cost. Divide the daily sample volume by realistic per-VM throughput to get concurrency, then convert to hardware using your vCPU overcommit ratio. Memory does not overcommit safely for malware analysis, so RAM usually sets the host count. Sandbox farms are sized on peak submission, not average: an incident that dumps ten thousand samples into the queue is exactly when analysts cannot wait six hours for a verdict.

Formulas

Sandbox Resource

concurrentVMs = samplesPerDay ÷ (1440 ÷ (runtime + resetTime) × utilisation); physicalCores = concurrentVMs × vCPU ÷ overcommitRatio.

runtime
Detonation window per sample
resetTime
Snapshot revert, boot and instrumentation setup
utilisation
Realistic duty cycle allowing for queue gaps and failures
overcommitRatio
vCPU packed per physical core

Artefact storage

artefactStorage = samplesPerDay × artefactSize × retentionDays, covering PCAP, memory strings, dropped files and screenshots.

artefactSize
Retained output per detonation
retentionDays
How long analysis output is kept for correlation

Worked example

With the default values below, Sandbox Resource Calculator returns Concurrent VMs Required of 26. Change any input above and every figure here is recalculated in your browser.

Inputs used

Samples to detonate per dayaccepts 1–5,000,000 samples/day
4,000 samples/day
Detonation runtime per sampleaccepts 0.5–240 minutes
5 minutes
Snapshot revert and setup per runaccepts 0–60 minutes
1.5 minutes
vCPU per analysis VMaccepts 1–64 vCPU
2 vCPU
RAM per analysis VMaccepts 0.5–512 GB
4 GB
Artefacts retained per sampleaccepts 1–100,000 MB
120 MB
Artefact retentionaccepts 1–3,650 days
90 days
vCPU overcommit ratioaccepts 1–16 ×
3 ×
Target farm utilisationaccepts 10–100 %
70 %

Results

Concurrent VMs Required
26 VMs
Runs per VM per Day
155.1 runs/day
Physical Cores Needed
18 cores
RAM Needed
120 GB
Artefact Storage
41.20 TB
Hosts at 64 Cores and 512 GB
1 hosts
Capacity Note
Balanced — keep 20% spare concurrency for incident-driven submission spikes

Step by step

  1. 1Values used
  2. 2Sandbox Resource
  3. 3Artefact storage
  4. 4Concurrent VMs Required= 26 VMs
  5. 5Runs per VM per Day= 155.1 runs/day
  6. 6Physical Cores Needed= 18 cores
  7. 7RAM Needed= 120 GB
  8. 8Artefact Storage= 41.20 TB
  9. 9Hosts at 64 Cores and 512 GB= 1 hosts

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Sandbox Resource calculated?

concurrentVMs = samplesPerDay ÷ (1440 ÷ (runtime + resetTime) × utilisation); physicalCores = concurrentVMs × vCPU ÷ overcommitRatio. Each VM completes 1440 minutes of day divided by its cycle time, where the cycle is the detonation window plus the snapshot revert — reverting is not free and on a five-minute runtime it is a fifth of the cost. Divide the daily sample volume by realistic per-VM throughput to get concurrency, then convert to hardware using your vCPU overcommit ratio. Memory does not overcommit safely for malware analysis, so RAM usually sets the host count.

Why does Sandbox Resource matter?

Sandbox farms are sized on peak submission, not average: an incident that dumps ten thousand samples into the queue is exactly when analysts cannot wait six hours for a verdict.

What values do I need to enter?

This calculator takes 9 inputs: Samples to detonate per day, Detonation runtime per sample, Snapshot revert and setup per run, vCPU per analysis VM, RAM per analysis VM, Artefacts retained per sample, Artefact retention, vCPU overcommit ratio, Target farm utilisation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why not overcommit memory as well as CPU?

Because ballooning and swapping change timing, and timing changes malware behaviour — some samples explicitly check for it. Overcommitted memory also risks a detonation being paged out mid-run, which produces a useless report.

Is a longer runtime always better?

No. Most commodity malware reveals its behaviour in the first two to three minutes, and doubling the runtime halves farm throughput. Reserve long runs for samples that show sleep or trigger-based evasion in the short run.

Related Calculators

Sandbox Resource Calculator | Calcrivo