For twenty years, the security of a file leaned on friction. A password-protected archive was safe because opening it took a step. A proprietary format was obscure because reading it took the right software. An encoding was a speed bump because turning it back into words took effort. None of that friction was cryptographic strength. It was just inconvenience, and inconvenience was enough to keep most content from being read at scale.
AI ingestion removed the inconvenience.
Hand a modern model a PDF, an image, a spreadsheet, an audio file, or a screenshot of a screenshot. It will reduce all of them to the same thing: text it can read and act on. The format stops mattering. The container stops mattering. Whether the words arrived as characters, as pixels in an image, as a QR code, or as a waveform, they converge on one plane the moment an AI touches them.
The question a boundary has to answer is no longer “what kind of file is this?” It’s “what will an AI read when it opens it?”
The cost that used to protect you is gone
Concealing content inside a file used to take skill. Today it takes a sentence. Ask a model to hide a credential set inside an image, to phrase an exfil payload so it dodges a keyword filter, to encode a message with a one-off cipher and hand back the key. It will, in seconds, in a form a person glancing at the file would never notice.
That is the real shift. It isn’t that attackers got a new capability. It’s that the effort that quietly did the defending was removed for everyone, on both sides of the wire. The same collapse that lets a defender’s AI read any file lets an adversary hide anything in one.
Why the existing layers can’t see it
Your stack is built around questions that are still worth asking: who is this user, is this channel allowed, is this endpoint healthy. But every one of those questions is about the envelope. None of them is about the content the envelope carries. A file can be sent by an authenticated user, over a sanctioned channel, from a compliant device, and still carry a payload that no layer in that path ever reads.
Tools that do look at content tend to validate the wrapper: the extension, the header, the schema. That is exactly the layer AI made irrelevant, because the wrapper is not what the AI reads. The gap is between the file as your tools classify it and the file as an AI, or an adversary, actually reads it.
Inspect the file the way it will be read
If content now lives on one plane, that is where inspection has to happen. Reduce every file, across every modality, to the text a model would extract from it. Make the decision there, before the file reaches anything that would act on it. Not by trusting a format. Not by reconstructing the file and hoping the payload didn’t survive. By reading what is genuinely there.
Two things fall out of doing it that way. First, direction stops mattering: a payload coming in and a secret going out are the same object seen from two sides, so one inspection covers both. Second, you don’t have to break the concealment to catch it. A message ciphered with a homemade key is unreadable, but the fact that ordinary-looking text has been made unreadable is itself the signal. You detect the concealment; you don’t have to decode it.
This is the premise the whole company is built on, and it’s why our first product does exactly one thing: it inspects a file the way an AI will read it — before the AI reads it.