The common thread is that the delivery vehicle is increasingly a file or a document-sharing workflow that looks entirely legitimate. Lures arrive as believable invoices and onboarding documents, often hosted on trusted platforms like OneDrive — one tax-themed campaign of this kind reached more than 29,000 users across 10,000 organizations. The recipient is no longer expected to run an obvious executable; they are expected to open a document that appears to belong in their workday.
That is the exact seam Content Analysis, Disarm and Reconstruction is built to close — and it is worth being equally clear about where the technology stops.
What CDR and FileDNA-style content analysis (CADR) actually do
Content Disarm and Reconstruction is a detection-independent approach. Rather than trying to decide whether a file is malicious, CDR assumes nothing in the file can be trusted, deconstructs it into its components, removes anything that does not conform to the file format’s legitimate specification or to policy (macros, embedded executables, scripts, suspicious objects), and rebuilds a clean, usable file. Because it does not depend on recognizing a known signature, it offers genuine zero-day protection against weaponized documents.
FileDNA, the CyberQuay product, is an implementation of this model combined with deep content analysis. FileDNA Content Analysis, Disarm and Reconstruction (CADR) technology analyzes a wide range of formats — Office documents, PDFs, RTF, HTML, scripting files, archives, images, and binary executables found as attachments — and performs embedded-object analysis “through any embedding levels,” then disarms and reconstructs the file while preserving its functionality. It can be embedded into any layer of cybersecurity products such as SIEM, EDR, IDPS, NGFW, email gateways, or file-sharing platforms, through linkable binary libraries or RESTful APIs.
The useful distinction between CDR and CADR:
Mapping the CADR technology to cybersecurity trends
Targeted document-based phishing — strong fit
This is the clearest use case. Lures built around onboarding documents, billing notices, renewals, and document-sharing flows are precisely the passive business file types — Word, Excel, PDF — that CADR was built to neutralize. The content-analysis stage surfaces the embedded object or macro hidden several layers deep inside an otherwise normal-looking invoice; the disarm-and-reconstruct stage removes it and rebuilds the document so the recipient still gets a working file. Because remediation does not rely on recognizing the specific lure, the protection holds whether or not that template has ever been seen before. For a high-volume target such as the services sector, applying CADR at the email gateway and at file-sharing ingestion points removes the file-borne element of these campaigns without forcing the security team to identify each new variant.
Abuse of legitimate services like OneDrive — placement-dependent fit
When the malicious document is fetched later from a trusted cloud link rather than attached to the original email, a gateway that only inspects inbound mail never sees it. CADR’s value here depends on where the engine is embedded. Because FileDNA can be linked into file-sharing and storage layers as well as network gateways, the document can be analyzed and reconstructed at the moment it is actually retrieved — not just when an email arrives. The lesson is architectural: CADR technology works best as a service distributed across several chokepoints, not as a single email appliance.
AI-generated phishing pages and fake applications — partial fit
The surge in AI-built phishing infrastructure — hundreds of thousands of generated site instances, tens of thousands flagged as malicious, including counterfeit wallet sites pushing fake browser extensions — is largely a web takedown problem, and CADR does not remove a hostile website. Two parts of the trend do fall inside its scope, however. The fake applications and browser extensions being distributed are packaged, executable content that a content engine can analyze and block, and the malicious scripting embedded in pages (.html, .hta, .js, .vbs and script files are within FileDNA’s analysis set) can be inspected and stripped in a web-security or ISP-gateway deployment that examines content in transit.
Encrypted delivery over HTTPS — a placement requirement, not a capability gap
The overwhelming majority of phishing and malicious activity now arrives over encrypted channels, with compromise increasingly happening in the browser over HTTPS. Content analysis operates on files in the clear, so a CADR engine only helps where traffic has already been decrypted — at a TLS-inspecting proxy or gateway, at the endpoint, or at the storage layer where files come to rest. This is a deployment precondition rather than a limitation of the technology: the sanitization layer must be positioned where files exist in cleartext, and organizations should plan TLS-inspection placement as part of adopting it.
Real-time MFA bypass (AiTM / BiTM) — out of scope, and worth stating
Adversary-in-the-middle and browser-in-the-middle kits reverse-proxy the victim’s session to the genuine identity provider and steal the live session token. Frequently no malicious file is involved at all. CADR does nothing against the credential or session theft itself; defending that vector requires phishing-resistant authentication such as FIDO2/passkeys, conditional access, and session-token protection. The honest position is that CADR reduces the file-borne initial-access that often precedes these campaigns, but it is not a control for the session-hijack mechanism, and no file-sanitization product should be sold as one.
Mass reconnaissance and cloud-hosted scanning — out of scope
Large-scale probing of exposed assets, leaked credentials, and forgotten subdomains — much of it launched from cloud-hosted infrastructure — is the domain of attack-surface management and network detection. It sits outside what file content analysis can address and should be excluded from any CADR claim set.
Where CADR earns its place
| Initial Access | File-borne initial access remains the on-ramp for the campaigns that matter most. Even as phishing becomes more targeted and business-mimicking, a large share of those lures still ride inside documents and shared files, and removing the weaponizable content from every inbound and shared file closes that on-ramp regardless of how convincing the social engineering is. |
| Detection Independence | Detection-independence matches a low-volume, high-customization threat. As attackers send fewer but more bespoke documents, signature and reputation systems have less to match against, while reconstruction needs no prior sighting — so CADR degrades gracefully exactly where detection-based tools degrade badly. |
| Integration | Breadth of integration is the differentiator. With attacks spanning email, cloud storage, and the browser, a content engine delivered as an API or linkable library that can sit at the gateway, the file-share, the endpoint, and the document-management system is far more useful than a single-channel appliance. |
The limits deserve equal clarity. CADR does not stop AiTM/BiTM session theft, fileless credential phishing, malicious websites, or network reconnaissance; it is only effective where files are available in cleartext, making TLS-inspection placement a prerequisite; and aggressive reconstruction can strip legitimate active content, so policy tuning is a real operational cost.
Attackers are trading volume for credibility and moving compromise into encrypted, trusted channels. Against that backdrop, Content Analysis, Disarm and Reconstruction — and FileDNA-style implementations that pair deep inspection with safe rebuilding — remain a well-matched control for the file-borne and document-sharing stages where many of these campaigns still begin. CADR is best understood as one layer in defense-in-depth: deployed across multiple chokepoints behind TLS inspection, paired with phishing-resistant authentication for the session-theft threat it cannot touch, and not oversold against the reconnaissance and AiTM trends outside its reach. Positioned that way, it addresses a vector that remains very much in use.
References
- Zscaler ThreatLabz 2026 Phishing and Initial Access Report
- CyberQuay, Inc. — FileDNA: Advanced Cybersecurity solution.
- Wikipedia — Content Disarm and Reconstruction.
- Glasswall — What is Content Disarm and Reconstruction (CDR)?
- OPSWAT — What is Content Disarm and Reconstruction.
- Check Point — What is Content Disarm and Reconstruction (CDR)?
- Kiteworks — Content Disarm and Reconstruction (CDR): Zero-trust Threat Protection.
- Everfox — Content Disarm and Reconstruction Software Tool.
- IRONSCALES — What is Content Disarm and Reconstruction (CDR)?
- ReversingLabs — File Analysis: What It Is, Types & How It Works.
- Group-IB — AiTM Attack Explained: How Adversary-in-the-Middle Works.