What is Content Disarm and Reconstruction (CDR)?

Last updated: 2026-08-20Browser Security

Content Disarm and Reconstruction (CDR) is a file-security technology that deconstructs a downloaded or emailed file, removes every element that could carry active code — macros, embedded objects, scripts — and rebuilds a clean, fully functional copy. Unlike antivirus scanning, CDR does not try to decide whether a file is malicious; it removes the possibility.

Also known as: CDR security · file sanitization · content sanitization · threat extraction

CDR vs antivirus scanning

Scanning asks "do I recognize this threat?" — and unknown or heavily obfuscated payloads routinely pass. CDR asks a different question: "what does the user actually need from this file?" It keeps the content (text, images, layout, data) and discards executable elements wholesale. The trade-off is that legitimate active content, like a spreadsheet macro the business depends on, needs a policy exception path.

Where CDR fits

CDR shines at the boundaries where files enter the organization: web downloads, email attachments and file uploads. In the Cyberdis portfolio it appears inside Menlo Security’s browser isolation platform — Votiro’s CDR technology rebuilds every download clean while the browsing session itself runs isolated in the cloud, covering both the page and the file in one control.

// In the Cyberdis portfolio

Menlo Security includes Votiro CDR in its browser platform — distributed by Cyberdis.

Explore Menlo Security Request a PoC

// FAQ

Common questions.

Does CDR break files?

Well-implemented CDR preserves full usability — text, formatting, images and data survive; only active elements are removed or sanitized. Files needing legitimate macros are handled through policy exceptions.

Is CDR better than sandboxing attachments?

They answer different questions. Sandboxes detonate files and watch for bad behavior — slow, and evadable by payloads that detect the sandbox. CDR is immediate and does not depend on the payload misbehaving on cue.

How do I get CDR without buying another point product?

Menlo Security ships Votiro CDR built into its browser security platform, so isolation and file sanitization arrive as one deployment — one of the reasons Cyberdis selected Menlo for its portfolio.

Weighing approaches? Browser isolation vs secure web gateway: what actually stops web threats?