If it has to phone home to decide, the internet is part of your file security

Ask where the verdict is computed. It is a boring question with an uncomfortable answer for most of the stack.

If the control reaches out to decide, then everything on the other end of that reach is now part of your file security. Their uptime is your uptime. Their bad deploy is your bad deploy. Their outage is a morning where either every file fails open or nothing moves at all, and you will not enjoy discovering which one your vendor chose on your behalf.

The dependency is also a coverage limit

An externally dependent control cannot run where there is no external. The air-gapped enclave, the ship at sea, the plant floor on an isolated segment, the classified side.

These are not exotic edge cases. They are precisely the environments where file crossings matter most and where an uninspected file has the highest cost. A control that needs the internet has quietly scoped itself to the parts of your estate that were never the hard part.

The sharper version

Now the one that should stop you.

If deciding requires uploading the file somewhere, then the decision has already moved the file off your boundary.

For an egress control, that is the exact thing you were trying to prevent, performed by the thing you bought to prevent it. The file left. It left to a third party, over the internet, in order to determine whether it was allowed to leave. Whatever the answer comes back as, the answer is late.

A threat feed is the same shape. It means the control only knows what somebody else has already published, and only after they published it.

That last point is worth sitting with. A feed-dependent control is structurally incapable of catching anything novel, because its knowledge is a subscription to other people’s hindsight. That is a fine property for a control that catches known malware. It is a useless one for a control whose entire job is concealment, since concealment is not a signature and never appears on a list.

Decide locally

Zero Trust for Files asks that nothing outside the boundary sits in the decision path. Not a cloud, not a feed, not a license check.

The control has the bytes in front of it. Everything needed to decide is in those bytes. Reaching anywhere else adds an outage, a dependency, an exfiltration channel, and a delay, in exchange for nothing the file was not already telling you.