Every new detection capability teaches the adversary something. A signature is published, and a variant appears that slips past it. A sandbox learns to watch for suspicious behavior, and malware learns to sleep until the sandbox stops watching. Defenders improve, attackers adapt, and the cycle starts again.

This arms race has shaped cybersecurity for decades. In most organizations, staying a step behind is an acceptable cost of doing business. For the Department of Defense (DoD), it is something else: a structural gap in mission assurance that capable adversaries are actively working to exploit.

Detection is a bet on the past

Antivirus, sandboxing and endpoint detection all work the same basic way. They compare what they see against what they already know to be bad, either a known signature or a behavior pattern that looks suspicious. When the match is good, they work well against commodity threats.

The weakness is built in. A detection tool can only recognize what it has seen before or what trips a heuristic. A novel exploit has no signature yet, and the gap between its creation and a signature becoming available can leave a window of exposure. Malware that detects a virtual machine or simply waits out a sandbox can pass behavioral analysis untouched.

None of this makes detection useless. It makes detection probabilistic. Every file it clears is probably safe, and the size of that "probably" depends on how much effort the adversary put into evading it.

Mission environments can't run on odds

The adversaries targeting DoD networks are not commodity attackers. In targeted operations against cleared defense contractors and DoD systems, they often build custom payloads designed to sit outside known signature libraries. Against that threat, a high catch rate offers little comfort. The one file that gets through is the one built specifically to get through.

The cost of that miss is also different. In a commercial setting, a missed threat usually means downtime and cleanup. In a defense setting, it is measured in mission impact: compromised planning data, exposed operational networks and a foothold an adversary can use when it matters most.

The tactical edge makes the problem sharper. Forward-deployed and disconnected networks often can't reach cloud sandboxes, centralized threat feeds or real-time signature updates. Tools that depend on that connectivity weaken precisely where operational risk is highest. A warfighter in a denied environment needs file security that works the same way offline as it does in the enterprise.

Change the question

Detection asks: is this file malicious? That question can only be answered by comparing the file to something already known.

There is a different question: what should a legitimate file of this type contain? That one can be answered from the file format's published specification, without knowing anything about the attacker. A PDF has a defined structure. So does a Word document or a JPEG. Anything outside that structure, such as embedded scripts, macros, anomalous metadata or hidden secondary formats, is usually content the mission can do without.

Answering this second question means rebuilding every file to its standard, keeping the content people rely on and discarding what policy doesn't allow. This is the principle behind Content Disarm and Reconstruction (CDR). The defining property of CDR is determinism: the output does not depend on whether a threat was recognized. A known exploit and a never-before-seen zero-day go through the same process, because the rebuild doesn't rely on recognizing either.

Because CDR works from published format specifications, it doesn't need signature updates, threat feeds or a cloud sandbox. It runs the same way on a disconnected forward network as it does in the enterprise.

Stop playing the adversary's game

The arms race favors attackers because their investment pays off. Every hour spent crafting a novel payload or an evasion technique buys a window of access until defenders catch up.

Deterministic content security, the approach CDR takes, breaks that equation. If every file is rebuilt to a known-good standard, a custom zero-day hidden in a document macro is removed for the same reason any macro would be. The adversary's investment in novel malware buys far less. There is no signature to evade and no sandbox to outwait.

That shift matters for how mission owners think about risk. Instead of asking how often a defense catches what it is shown, they can ask whether its protection holds regardless of what it is shown. One is a catch rate. The other is a consistent process applied to every file.

Assurance is a mission requirement

Detection will remain part of a layered defense. It is good at what it does. But for files moving into the networks that support operations, from coalition partners, contractors, software pipelines and the tactical edge, the question is not whether a tool catches most threats. It is whether every file is rebuilt to a known-good standard before it reaches a warfighter.

This is Zero Trust applied to files: treat every file as untrusted and rebuild it before it's used.

Commanders don't plan operations on "probably." The files those operations depend on shouldn't be secured that way either.

Read the Glasswall brief, Eliminating the DoD Zero Trust File Blind Spot, to see how deterministic content security completes the Zero Trust Data pillar.