File-centric security protects the file itself instead of relying only on the network or endpoint around it. The core idea is that a document may leave the original system, but its controls should travel with it. This often includes persistent encryption, file-level permissions, usage limits, and audit logs that remain attached as the file moves through email, cloud storage, partner systems, or removable media.
This approach matters because many attacks do not break the perimeter at all; they abuse valid logins, over-shared documents, or careless forwarding. If a sensitive file is copied to the wrong place, file-centric controls can still block opening, editing, printing, or sharing, and they can reveal who accessed it. Defenders use these features to reduce data leakage, support incident response, and make trust decisions based on the file’s actual handling rather than assumed network safety.