---
title: "Introducing File Security 101: Why a Clean Scan Doesn't Make a File Safe"
description: "File Security 101: a 101-episode series on how everyday files are misused, why a clean anti-malware scan is not enough, and how bowbridge CDR helps."
image: https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg
---
[customer login](https://www.bowbridge.net/customer-portal/) english deutsch
[](https://www.bowbridge.net/en/)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [DE](https://www.bowbridge.net/de/)
- [EN](https://www.bowbridge.net/en/news.html)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
# Introducing File Security 101: Why a Clean Scan Doesn't Make a File Safe
Nov 10, '26 by Joerg Schneider-Simon
A file passes the anti-malware scan, so it must be safe. Most of us have made that assumption at some point. It is also the assumption attackers count on.
Today we are launching **File Security 101**, an educational series about the ways everyday files — PDFs, Office documents, images, fonts, emails and archives — can be misused, and why many of those threats pass a scan without a trace.
## Why we started this series
Anti-malware is built to recognise malicious code: known signatures, suspicious behaviour, exploits for known bugs. That is essential, and it catches a great deal. But a large share of file-based attacks contain no malicious code at all. They use features the file format offers by design.
A PDF can tell the reader to start a program. A Word document can fetch a template from a remote server when it opens. An image can carry a second file behind its last pixel. A résumé can contain white-on-white text that only an AI screening tool will read. None of this needs a software bug, and none of it necessarily looks like malware to a scanner — because, technically, it isn't.
Other risks are not attacks on the computer at all: metadata that reveals who wrote a document and where, tracked changes that still contain what was "deleted", a tracking pixel that reports when an email was opened.
A clean scan answers one question: does this file contain known malicious code? It does not answer the question that matters to the business: is this file safe to open, process or pass on? File Security 101 is about the gap between those two questions.
## What File Security 101 covers
The series has 101 episodes. Each one takes a single scenario and explains it in a short "How it works" video of about two to three minutes, together with an article that adds the technical details, real-world cases and research behind it. Topics include:
- **Active content in documents** — macros, DDE fields, OLE packages, remote templates, ActiveX and JavaScript in PDFs.
- **Images and fonts that do more than display** — SVG with script, polyglot files that are two formats at once, font programs and colour profiles that live elsewhere.
- **Email and calendar** — HTML smuggling, winmail.dat, tracking pixels, display-name spoofing and invites that act on their own.
- **Hidden data and leaks** — EXIF and GPS data, tracked changes and comments, hidden text and custom XML parts.
- **Attacks on the systems that process files** — XXE and XInclude, "billion laughs" parser bombs, archives with paths that escape their folder.
- **Instructions meant for machines** — invisible text aimed at AI tools and other automated readers.
The series is vendor-neutral and written for everyone who handles files at work: security and IT teams, application owners, and anyone curious about what a document really contains.
## From File Security 101 to bowbridge CDR
Witnessing how many organisations place almost blind trust in a file once it has been declared "malware-free" — and let it straight into their business applications, archives and, increasingly, AI workflows motivated us to look for a different approach to file security. A Zero-Trust Approach. So we developed bowbridge Content Disarm and Reconstruct (CDR).
CDR does not ask whether a file looks malicious. It takes supported files apart and builds a new file using only copies of known-safe elements, such as layout, text and images. Everything else stays behind, and your application or AI agent processes only the new file.
CDR does not replace anti-malware; it complements it. The short video below shows how it works.
### Join the bowbridge CDR beta
We are inviting teams to test CDR in their own workflows before release — for files uploaded to SAP applications, files attached to Salesforce records, and agentic AI workflows via MCP. Participation is free, and you do not need to be an existing bowbridge customer.
[Join the bowbridge CDR beta program](https://explore.bowbridge.net/en/cdr-beta)
## Start with Episode 1
The first episode shows how a PDF can start a program on your computer with a single instruction — no malicious code and no software bug required. In 2010, criminals used exactly this technique within weeks to install the Zeus banking trojan.
New episodes appear on the [File Security 101 blog](https://explore.bowbridge.net/file-security-101), where you can also subscribe to be notified when the next one is published, and on our [YouTube playlist](https://www.youtube.com/playlist?list=PLeJP4TPJj9w8).
[View and read Episode 1](https://explore.bowbridge.net/file-security-101/episode-1-a-pdf-that-starts-a-program)
#### Share this on social:
[Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fexplore.bowbridge.net%2Fblog%2Fintroducing-file-security-101&title=Introducing+File+Security+101%3A+Why+a+Clean+Scan+Doesn%27t+Make+a+File+Safe&summary=File+Security+101%3A+a+101-episode+series+on+how+everyday+files+are+misused%2C+why+a+clean+anti-malware+scan+is+not+enough%2C+and+how+bowbridge+CDR+helps.) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fexplore.bowbridge.net%2Fblog%2Fintroducing-file-security-101&text=Introducing+File+Security+101%3A+Why+a+Clean+Scan+Doesn%27t+Make+a+File+Safe) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fexplore.bowbridge.net%2Fblog%2Fintroducing-file-security-101) [Share via Email](mailto:?subject=Introducing+File+Security+101%3A+Why+a+Clean+Scan+Doesn%27t+Make+a+File+Safe&body=https%3A%2F%2Fexplore.bowbridge.net%2Fblog%2Fintroducing-file-security-101)
### Don't miss the latest SAP security news
#### bowbridge
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [About bowbridge](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [Customer Login](https://www.bowbridge.net/customer-portal/)
#### Contact
**GERMANY**
Tel: +49 (0) 6227 - 69899 - 50
Fax: +49 (0) 6227 - 69899-59
Email: [info@bowbridge.net](mailto:info@bowbridge.net)
**USA**
Tel: +1 650 - 617 - 3408
Fax: +1 650 - 617 - 3201
Email: [us-sales@bowbridge.net](mailto:us-sales@bowbridge.net)
#### Connect With Us
- [English](https://www.bowbridge.net/en/)
- [Deutsch](https://www.bowbridge.net/)
Copyright © 2023 bowbridge Software GmbH. All rights reserved. [Privacy Policy](https://www.bowbridge.net/en/privacy-policy)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Joerg Schneider-Simon",
"url" : "https://explore.bowbridge.net/blog/author/joerg-schneider-simon"
},
"dateModified" : "2026-11-10T14:17:54.171Z",
"datePublished" : "2026-11-10T14:17:54.000Z",
"headline" : "Introducing File Security 101: Why a Clean Scan Doesn't Make a File Safe",
"image" : [ "https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg" ],
"mainEntityOfPage" : {
"@id" : "https://explore.bowbridge.net/blog/introducing-file-security-101",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://explore.bowbridge.net/hubfs/bowbridge_logo_2-1.png"
},
"name" : "bowbridge Software GmbH"
}
}
```