Content Disarm and Reconstruction (CDR) is a preventive security technique that opens an incoming file, removes risky active elements, and rebuilds a safer version for the recipient. It typically strips macros, scripts, embedded objects, and other features that can execute code or trigger exploitation. The goal is to deliver the useful content, such as text or images, without preserving hidden attack paths.
CDR matters because many attacks begin with a normal-looking document or archive sent by email, uploaded through a portal, or moved between networks. Unlike detection tools that look for known malware, CDR reduces risk even when the payload is novel or file-based malware is disguised. Defenders use it in email gateways, secure file transfer systems, and critical-infrastructure environments where a malicious attachment could cause disruption. Its main tradeoff is compatibility: aggressive sanitization can remove legitimate features, so policies must balance security and workflow needs.