Content Disarm & Reconstruction evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 8 vendors in this category.

• baselineRFIWhat file types does the platform sanitize (Office documents, PDFs, images, archives) and does sanitization preserve document usability/formatting fidelity, or does the reconstructed file frequently break formatting or lose legitimate active content (macros, embedded objects) users actually need?weight 3
  Answer key — what a strong answer shows

  A CDR product that reliably breaks legitimate document formatting or strips content users need drives real user friction and workarounds; ask for a fidelity-preservation figure or a live demonstration on realistic complex documents, not simple test files.

• baselineRFPDescribe the sanitization approach — does it rebuild files from a known-safe structure (true CDR) or merely scan-and-strip suspicious elements from the original file (a hybrid approach with residual risk) — and what is the vendor's position on zero-day exploit protection versus signature/pattern-based sanitization.weight 3
  Answer key — what a strong answer shows

  True structural rebuild-from-safe-parts CDR provides protection against unknown/zero-day exploits by design, since it doesn't rely on recognizing malicious patterns; a scan-and-strip hybrid has more residual risk against novel techniques — ask the vendor to be specific about which model they implement.

• baselineRFIWhat is the processing latency added to file delivery (email attachment, file upload, download) under realistic production volume, and does this create a noticeable delay for end users receiving time-sensitive files?weight 3
  Answer key — what a strong answer shows

  CDR reconstruction is computationally more intensive than simple malware scanning; ask for a measured latency figure under production load, not a lab benchmark, since added delay is a common real-world adoption friction point.

• baselineRFIHow does the platform handle files where legitimate active content (macros in a finance team's Excel workflow, for example) is a genuine business requirement — is there a policy exception mechanism, or does CDR uniformly strip active content regardless of business need?weight 3
  Answer key — what a strong answer shows

  A policy-based exception mechanism for specific verified business workflows is more practical than a uniform strip-everything approach that breaks legitimate use cases and drives shadow-IT workarounds.

• baselineRFPDetail deployment points — email gateway, web/file upload, removable media, or all three — and whether coverage is consistent across every ingestion point in the customer's environment or concentrated on just one channel (commonly email) leaving other channels unprotected.weight 3
  Answer key — what a strong answer shows

  Attackers will use whichever channel isn't protected; ask for an explicit per-channel coverage breakdown rather than assuming uniform protection because 'CDR' is in the product name.

• baselineRFIWhat visibility and reporting exists for what was actually removed/modified during sanitization — can a security team or the recipient see exactly what active content was stripped from a given file, or is sanitization a silent black-box process?weight 3
  Answer key — what a strong answer shows

  Transparent reporting on what was stripped helps both security teams tune policy and end users understand why a file looks different, rather than a silent, unexplained transformation that erodes user trust in the tool.

• baselineRFIWhat is the pricing model — per user, per file volume, or a flat enterprise tier — and how does cost scale as file-transfer volume grows significantly across the organization?weight 3
  Answer key — what a strong answer shows

  Look for transparent, predictable scaling economics tied to realistic file-volume growth, not just a per-file price that becomes unpredictable at scale.

• baselineRFPWhen sanitization strips content from a file that turns out to have been a genuine, sophisticated exploit attempt (not just routine active-content stripping), does that event feed into broader incident-response/threat-intelligence workflows, or does it remain an isolated, unreported sanitization log entry?weight 3
  Answer key — what a strong answer shows

  A CDR block of a real targeted exploit attempt is meaningful threat-intelligence signal — ask whether this is surfaced to the security team as a genuine incident, not just silently logged as routine sanitization.

• baselineRFIDetail historical trend reporting on sanitization volume and the proportion of files containing genuinely suspicious active content over time, suitable for demonstrating threat exposure to leadership.weight 3
  Answer key — what a strong answer shows

  Trend-over-time reporting is a distinct capability from per-file sanitization logs — confirm this exists as a maintained, exportable report.

• baselineRFIHow does the platform integrate with the customer's existing email-security and malware-analysis stack — is CDR a genuinely complementary layer, or does deployment require a separate, disconnected management console from the rest of the email-security pipeline?weight 3
  Answer key — what a strong answer shows

  Look for genuine integration into the existing email-security workflow; a standalone CDR console disconnected from the broader stack creates real operational complexity.

• baselineRFIWhat is the vendor's honest disclosure of any known file types or techniques that can evade sanitization, and what testing has been done to measure evasion resistance rather than only advertising the technique's theoretical zero-day-proof design?weight 3
  Answer key — what a strong answer shows

  Even true rebuild-based CDR can have edge-case gaps — a vendor willing to discuss known limitations is more credible than one claiming absolute protection with no caveats.

• baselineRFPWhat compliance-evidence generation exists showing sanitization was active and applied to all relevant file traffic (for a secure-email-gateway audit requirement), and is this a built-in exportable report or something the security team must assemble manually?weight 3
  Answer key — what a strong answer shows

  Native compliance-evidence generation is materially more valuable than raw sanitization logs requiring manual compilation for every audit cycle.

• baselineRFIHow consistent is sanitization coverage and processing latency across multi-cloud/hybrid deployment (on-prem gateway, cloud email provider integration, web upload) — is depth equally mature across every ingestion point, or meaningfully shallower for one?weight 3
  Answer key — what a strong answer shows

  Ask for an honest per-deployment-point coverage breakdown; uneven coverage across ingestion channels is a common real gap a vendor should disclose rather than obscure.

• baselineRFPWhat API/developer integration exists for embedding CDR into custom file-upload pipelines or internal applications, beyond the standard email-gateway/web-upload deployment points?weight 3
  Answer key — what a strong answer shows

  A real, documented API is materially more useful for a team wanting to build sanitization into their own custom workflows than being limited to pre-built deployment points.

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.