Content Disarm and Reconstruction (CDR) is a Zero Trust file security technology that rebuilds files to a manufacturer's known-good specification, removing threats before they can execute. If you're new to CDR, our What is Content Disarm and Reconstruction (CDR)? article covers how it works in full. This article focuses on something more specific: how Glasswall's CDR technology is built, from the ground up, to Secure by Design principles — and what that means for the organizations relying on it.
Security teams often ask how CDR fits alongside the detection tools they already run. CDR complements antivirus and sandboxing by addressing the gap before detection-based tools can identify new or unknown threats. Here's how the three approaches handle the same incoming file:
How it handles a file: Scans file content against a database of known malware signatures or behavioral patterns.
Where it falls short: Can't stop zero-day or previously unseen threats; only catches what it already recognizes.
How it handles a file: Detonates the file in an isolated environment and observes its behavior before allowing it through.
Where it falls short: Takes time, can be evaded by malware built to detect and stall in sandboxes, and still requires the threat to activate before it's caught.
How it handles a file: Rebuilds the file against its manufacturer's known-good specification, removing anything that doesn't belong, regardless of whether it's recognized as malicious.
Where it falls short: Security efficacy results vary by vendor; and usability of the rebuilt file depends on how the CDR process is engineered.
The common thread with antivirus and sandboxing is that both work by trying to catch a threat in the act, whether by recognizing it or watching it behave badly. CDR skips that step. It doesn't ask whether a file is dangerous. It removes the parts of a file that could be dangerous and delivers a clean, working version, before execution ever becomes a question. That's what "prevention before detection" means in practice, and why CDR is increasingly used to complement, not replace, antivirus and sandboxing in a layered defense.
"Secure by Design" isn't a single standard. It refers to a development philosophy, and two major frameworks have shaped how it's applied: the CISA/NSA-led international Secure by Design guidance, and the UK Government's 10-principle Secure by Design model. Glasswall's Content Disarm and Reconstruction (CDR) technology is built in line with both.
In October 2023, the US Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) led an update to joint Secure by Design guidance, co-published with more than 17 international partner agencies, including the UK's NCSC. Rather than ten discrete principles, this guidance is built around three core commitments:
Software manufacturers should take responsibility for the security outcomes their customers experience, not just for shipping a working product. Glasswall reflects this through named executive risk ownership: risks identified across the product development process are reported directly to our CPO, who sits on our senior leadership team and is accountable for how those risks are managed.
Manufacturers should be open about their security practices, vulnerabilities and how they're addressed, rather than treating security as a competitive secret. Glasswall reflects this through continuous assurance activity and direct engagement with government and regulated customers who require external validation of our security posture, including alignment with NCSC and NSA expectations.
Security should be a leadership priority, not something delegated entirely to engineering teams. Glasswall reflects this through our governance structure: security risk, usability trade-offs and proposed changes are all escalated to and reviewed by our CPO before release.
The UK Government's Secure by Design development model sets out ten core principles that organizations delivering digital services should follow. These principles build on the National Cyber Security Centre's (NCSC) Secure Design Principles for Cyber Secure Systems, extended to cover the whole product development lifecycle.
Impact: Cybersecurity risks are escalated to senior management and dealt with by the most senior stakeholders, in line with the organization's risk appetite.
How Glasswall adheres: Our specialist engineering team reports on risks identified during product development directly to our Chief Product Officer (CPO), a member of our senior leadership team.
Impact: Continuously reviewing technology products and open-source code lets organizations make informed decisions on the trade-offs between security and usability.
How Glasswall adheres: We have dedicated teams responsible for continuous testing and monitoring of our technology's protection capabilities, source code integrity, usability and the wider threat landscape.
Impact: Lets organizations dynamically manage risk and design proportionate safeguards.
How Glasswall adheres: Glasswall CDR is deployed across sensitive networks and high-assurance solutions, as well as commercial organizations with lower risk thresholds. Our Policy Management API gives security teams the ability to configure content policies that match their organization's risk appetite.
Impact: Security controls work best when a solution is designed to be as user-friendly as possible.
How Glasswall adheres: Our UX team continuously tests, analyzes and updates our products based on real-world user feedback and in-house testing.
Impact: Reduces the likelihood of weak points where a compromise could occur and go undetected.
How Glasswall adheres: Our patented 4-step CDR process fulfils the Protect, Detect, Respond and Recover functions of the cybersecurity framework:
Impact: Lets solutions adapt quickly to a changing risk landscape and shifting business demands.
How Glasswall adheres: The Glasswall CDR Platform and Glasswall Halo run on a Kubernetes architecture that scales to meet demand. An OpenAPI specification-compliant design provides developer-centric web services, and open-source connectors support straightforward on-premises and cloud integration.
Impact: Reduces the attack surface without cutting service capability.
How Glasswall adheres: Glasswall CDR solutions are built to be as lean as possible. Our range of APIs supports simple integration with other solution architectures, including hardware-based and high-assurance environments.
Impact: Increases the time and effort a threat actor needs to fully compromise a service.
How Glasswall adheres: We follow a Zero Trust methodology. Through our partner network and API integration capabilities, we support a layered approach that focuses on technology and minimizes human error.
Impact: Gives risk owners confidence that services operate securely and as intended.
How Glasswall adheres: Glasswall CDR is used in bespoke high-assurance solutions operating within UK, US and other government networks, which requires security assurance both internally and externally, including with the NCSC and NSA.
Impact: Ensures changes can't be made to an operational service without proper consideration of their security impact.
How Glasswall adheres: Our engineering team tests and identifies any limitations caused by proposed changes, and escalates issues to the CPO for review. Our UX team reviews every update to confirm usability isn't affected.
Together, the UK's ten principles and the CISA/NSA three commitments describe the same underlying idea from two directions: security has to be owned, designed in and defended at every level of a product's lifecycle, not patched on after launch.
Our patented CDR process is designed in line with Secure by Design principles from both frameworks above. At its heart is a 4-step process, inspect, repair, clean and deliver, that rebuilds every file back to its manufacturer's known-good specification.
Returning files to their manufacturer's known-good specification is what sets Glasswall apart from other approaches to CDR. Some CDR providers flatten files, which strips out their usability along with any threat. Others rebuild files using non-proprietary libraries that don't always conform to the known-good specification, so the rebuilt file's structure can still fall short of published security standards.
Glasswall CDR removes the parts of a file that don't belong, before execution, and returns a fully usable file that matches its manufacturer's known-good standard. Users get files they can open with confidence, without waiting on detection to catch up.
For a full explanation, see What is Content Disarm and Reconstruction (CDR)?
Antivirus depends on recognizing known threats. Sandboxing depends on observing a file's behavior in an isolated environment before release. CDR does neither. It rebuilds files against a known-good standard regardless of whether a threat is recognized or has activated, which is why it can stop zero-day threats that detection-based tools miss.
Glasswall CDR is built to process common office documents and other widely used file formats, rebuilding each one against its own manufacturer specification.
No. Secure by Design is a development philosophy and set of principles for building software securely from the start. CDR is a specific technology that puts a prevention-before-execution approach into practice for file-based threats. Glasswall builds its CDR technology in line with Secure by Design principles, but the two terms aren't interchangeable.
No. CDR addresses a gap that detection-based tools can't close on their own, namely the risk in the moment before a threat is recognized. Most organizations run CDR alongside antivirus and other detection tools as part of a layered, Zero Trust defense.
Glasswall CDR removes file-based threats before they execute, without waiting for detection to catch up.
Glasswall's Marketing Director, Jake, drives strategies that empower the company's sales teams. A highly creative and seasoned industry professional, his passion for branding and customer-focused messaging fuels growth across domestic and international markets.
A tailored walkthrough of how Glasswall rebuilds files to a known-good state, removes hidden threats, and provides the intelligence you need to understand file risk.
What's in the demo
“
Beazley's security is paramount, and this integration has significantly reinforced our cybersecurity framework.
