A file-borne threat is malicious code or content delivered inside a file such as a document, archive, spreadsheet, script, or installer. The danger is not direct network exploitation, but what happens when a user opens the file or when an automated workflow processes it. The file may contain macros, embedded objects, scripts, weaponized compression, or hidden payloads designed to run in the target environment.
This matters because files are one of the most common entry points in cyber attacks, especially through email, file sharing, and supplier exchanges. Defenders reduce risk with attachment filtering, multi-AV scanning, sandboxing, and content disarm and reconstruction (CDR), which strips active content and rebuilds safer files. In critical infrastructure, where uptime is essential, blocking or sanitizing file-borne threats can prevent malware execution, credential theft, and disruption before the content reaches operational systems.