A file does not know which direction it is going

Your organization inspects files twice. Once on the way in, by a sandbox and a mail gateway and an AV engine. Once on the way out, by whatever your DLP can pattern-match. Two products, two teams, two budgets, usually two vendors.

It is one object, crossing one boundary, and it does not know which way it is pointed.

The split is a market artifact, not a technical one

Inbound became a malware problem because that is where the money was in the late nineties. Outbound became a loss problem because that is where the regulations landed a few years later. The two grew up in different buildings, and the tools inherited the geography.

But look at what the inspection actually is. A payload concealed inside an image on the way in. A credential set concealed inside an image on the way out. Same container, same concealment, same decoding, same question: what is actually in here. The only thing that differs is which way the file was pointed, and the file has no opinion about that.

Nothing about the problem is directional. Only the org chart is.

The asymmetry is the attack

Here is what that costs you. Twenty-five years of investment went into the inbound side. Detonation, unpacking, structural analysis, recursion into archives. The outbound side got regular expressions and a list of file extensions.

So the same technique fails in one direction and succeeds in the other. A cipher your sandbox would have flagged on the way in sails out as a text file, because the thing watching the exit was never built to ask the question the thing watching the entrance asks routinely.

An adversary does not have to defeat your best control. They have to notice you only pointed it one way.

The same concealment technique gets caught coming in and walks going out. Not because the technique got better. Because it turned around.

One inspection, both directions

A file layer that only looks one way is not a file layer. It is half of one, and the half it is missing is the half your data leaves through.

This is the second thing Zero Trust for Files asks of a control: judge the object, not the direction. If you can read what is actually inside a file arriving, you can read what is actually inside a file leaving. It is the same read.

Doing it once and calling it inbound security is a decision about budget, not about risk.