How is CDR different from antivirus and sandboxing?

Antivirus compares files against a database of fingerprints for known malware. Sandboxing detonates the file to watch what it does. Both try to recognize the threat. CDR does not ask whether a file is malicious: it strips non-compliant elements and active content, then rebuilds a clean file.

Will rebuilt files still work?

The rebuilt file is visually and functionally identical to the original. Trusted macros and URLs can be added to a whitelist through policy management, so they are preserved instead of sanitized.

Which file types does klearis support?

Office, PDF, image, video and audio, archive, text and mail formats are covered. Archives and nested archives are sanitized under the same policies.

Where can klearis be deployed?

On-premise, in air-gapped and isolated networks, at the boundary between networks of different classification levels, and for bulk file processing.

How does klearis connect to the tools we already run?

Through the REST API, Server Agent, Mail Gateway, ICAP, browser extension, Outlook add-in, desktop client and the central Web UI. Sanitization and audit logs can be sent to SIEM platforms.

Content Disarm and Reconstruction (CDR)

How CDR works

Traditional defenses all try to recognize the threat.

Antivirus matches signatures of known malware. Sandboxing watches behavior.Both break against a zero-day, an exploit unknown to the vendor, with no signature and no tell.

A simple analogy · Three ways to secure the same gate

A security gate with a board of known threats; a file that is not on the board walks straight through

ANTIVIRUS

The guard with a wanted poster

Matches each face against known criminals. If it matches, stop them. If it doesn't, they walk straight through.

PROCESSING~ seconds

A file watched inside an observation room while other files wait outside

SANDBOX

The interrogation room

Pull the suspect into a sealed room and watch for dangerous behavior before letting them into the terminal.

PROCESSING~ minutes

A file passing through a decontamination chamber and leaving clean

KLEARIS · CDR

The decontamination chamber

Never checks if anyone is "bad." Everyone gets a clean change of clothes and passes through, every threat left at the door.

PROCESSING~ milliseconds

The Gryphon Engine Identify, disarm, rebuild: a deterministic process run on every file. How CDR works →

Why klearis

Protection that does not slow work down.

ZERO-DAY Unknown threats removed Active content is removed whether a threat is known or not.

NO SIGNATURES Prevention without detection Every file is rebuilt, so protection does not depend on recognizing the threat.

POLICY Configurable per team Policies follow your organization: by user group, by integration, by file format.

DEPLOYMENT On-premise and air-gapped Runs on infrastructure you own, with no cloud dependency.

SPEED Sub-second processing Files are rebuilt in line, with no quarantine queue to wait on.

FIDELITY Files that still work Rebuilt files are visually and functionally identical to the originals.

INTEGRATION Connects where files arrive REST API, ICAP, Mail Gateway, Server Agent and more, managed from one Web UI.

FILE TYPES Broad file coverage Office, PDF, image, video and audio, archive, text and mail formats, including nested archives.

#hs_cos_wrapper_dnd_area-module-23 .cp-faq__a { grid-template-rows: 1fr !important; } #hs_cos_wrapper_dnd_area-module-23 .cp-faq__a[hidden] { display: grid !important; } #hs_cos_wrapper_dnd_area-module-23 .cp-faq__a-inner { overflow: visible !important; }

FAQ

Frequently asked questions

What CDR does and does not do →

CDR treats every file as untrusted and rebuilds it from the elements its format allows, so threats are left out whether they are known or new. It is a shift from detection to prevention.

Every file sanitized.
Nothing left that can run.