A file-based scan is a security check that inspects the contents of files stored on disk. It compares what is saved on the filesystem against known-good patterns, hashes, signatures, or policy rules. This is useful for finding malware, unauthorized edits, and exposed secrets in static code or configuration files.
In cyber security, file-based scans matter because they are fast, scalable, and easy to automate. However, they only see what is on disk. If an attacker changes a script in memory, hooks a server process, or alters the response generated at runtime, a file-based scan may still report a clean file even though users receive malicious content.
Defenders use file-based scans as one layer of detection, often alongside runtime monitoring, response diffing, and integrity checks on active services. The key limitation is simple: a clean file does not always mean a clean service.