What is Content Disarm & Reconstruction (CDR)?

What it does

CDR treats every incoming file as untrusted. Instead of scanning for known malware signatures, it deconstructs the file into its component parts, such as text, images, fonts, and metadata. It keeps only the elements that conform to the file format specification and discards everything else. It then reassembles a new, structurally clean file and delivers that to the recipient.

This process removes:

• Embedded macros and scripts
• Exploit code hidden in document metadata
• Active content such as JavaScript in PDFs
• Malicious objects embedded in Office files

CDR sits inline, meaning it processes files before they reach the user. It applies to email attachments, browser downloads, file transfer portals, API uploads, and data copied from removable media.

Why teams buy it

Signature-based antivirus and sandboxing miss zero-day threats because they rely on prior knowledge of the malware. CDR does not need to identify the threat. It removes all active content by default, so a never-before-seen exploit has nothing to execute.

Teams in regulated industries, critical infrastructure, and high-security environments use CDR when they cannot accept the risk of a file-borne attack reaching an endpoint. It is often deployed alongside Email Security Platforms and Anti-Phishing tools as a last line of defense for file-based threats.

What to look for

• File format coverage: The tool should support the formats your users actually receive, including Office documents, PDFs, images, archives, and CAD files.
• Fidelity: The rebuilt file should look and function like the original. Poor fidelity frustrates users and creates workarounds.