Fissure Security FISSURESecurity
Subtext · Zero Trust for Files

It inspects a file the way an AI will read it — before the AI reads it.

File formats, encodings, even the difference between an image and a document. AI ingestion dissolved all of it into one thing: text. Subtext meets a file on that plane and decides, deterministically, whether to let it through.

<10 ms  median per file 0  cloud calls air-gap  ready
Book a demo → See the benchmark
What it is

A layer that reads the content itself.

Subtext sits wherever files go in or out, whether the reader is a person or a model: email, transfer in and out, the documents your AI retrieves, and the files an agent reads through MCP. Every file is reduced to the text an AI would read before it is judged, and more than 130 formats are also opened structurally, so the text it judges includes what was inside them. Then it returns one of three answers.

PassNothing of concernThe content is what it claims to be. The file moves, untouched.
ReviewSend to a humanSomething warrants a look. Subtext explains exactly what, per signal.
BlockConcealed contentA payload the container was hiding. Stopped at the boundary, evidence preserved.

The file is preserved, not mutated. Subtext returns a verdict. It does not quietly rewrite your data or throw away the evidence of what was hidden.

What it catches

The container says one thing. The content says another.

Every layer that validates the wrapper (the extension, the header, the schema) passes these. Subtext reads what’s actually rendered. Hover a card to see what it found.

Declared · a QR code image A harmless-looking graphic in a PDF.
Actual Decoded, the code carries a live credential set (username, password, API key) walking out as a picture no keyword filter can see.
Hover →
Declared · a routine resume A PDF headed for your AI screener.
Actual The body carries instructions aimed at the model reading it: a prompt injection that tries to turn your own AI into the attacker’s tool.
Hover →
Declared · an audio clip A voice memo. A song. A .wav.
Actual Secrets spoken aloud, or painted into the spectrogram as text, ride the audio out. Subtext listens and looks, then reads the result.
Hover →
Declared · a plain text file Ordinary characters. Nothing flagged.
Actual Content ciphered or encoded with a homemade key to defeat dirty-word and schema filters. Exfil in plain sight. Subtext sees the concealment, without needing to break the code.
Hover →

Same in both directions. A payload coming in and a secret going out are the same problem. Content has no direction.

How it fits

Built to drop into places other tools can’t reach.
Self-contained No cloud, no feed It ships as a container and runs entirely on your side of the wire: no external calls, no threat feed to keep current. It works the same on an air-gapped or shipboard network as it does on the internet.
Deterministic A verdict you can audit Every decision is explainable, signal by signal, and repeatable. The same file yields the same answer, the kind of behavior a control has to have to be trusted at a boundary.
Complementary A layer, not a rip-and-replace It sits alongside your gateway, your mail security, your cross-domain guard, and reads the content those layers were never designed to. It adds the missing question, it doesn’t replace the stack.
See it run

One file. One path. A verdict you can read.

Pick a file that looks ordinary. Watch Subtext take it apart the way an AI would, layer by layer, until what the container was hiding is on the table. The same path runs for every format, and for everything nested inside it: a JPEG with a payload welded past its end, a ZIP wearing a .pdf name, an executable buried in a disk image, or a ClickFix page that tells the reader to paste a command and run it.

—
One inspection path
Type
content vs. extension
Structure
where the file declares it ends
Re-enter
members read as files
Read as text
content signals
Verdict
block · review · pass
the original bytes are never modified

Illustrative walkthrough. The verdict a real scan returns is the same shape: block, review, or pass, with the reason chain that produced it.

Proof

More accurate than a frontier model, and orders of magnitude faster.

“Can’t an AI just do this?” is the first question everyone asks. We ran the same files through Subtext and through a frontier-model agent. Subtext was more accurate on concealed content and fast enough to sit inline, because it’s purpose-built for one question, not a general model asked to improvise an answer.

Subtext vs. a frontier model: the numbersAccuracy and per-file latency on the same corpus, head to head. Benchmark → Prove it on your own filesSynthetic samples that demonstrate each seam. Run them yourself. GitHub →

Up and inspecting in under five minutes.

Bring up the container, score a file. A file that turns out to be malicious cannot affect the environment that inspected it. No internet connectivity, no cloud account, no phone call required.

Hand it a file you’re sure is safe. Watch what it finds.

Book a demo → About Fissure