Boundary File Risk Removal
Every file is validated against its specification and rebuilt to a known-good standard in under a second, with active content and structural anomalies removed by construction. No signatures, no detonation, no waiting. The first control on upload portals, gateways, Microsoft 365, and transfer paths.
Glasswall HaloCDR
Explore the products
Secure Collaboration and Repository Hygiene
Files are rebuilt as they are uploaded to SharePoint, OneDrive, and Teams by Microsoft 365 storage protection. Staff open and share documents in the same libraries, with no change to how they work.
Glasswall HaloMicrosoft 365 storage protectionIntegration APIs
M365 and API integration
Incoming and Outgoing Email Protection
Email is a common way in for malware. The email relay sits in your mail flow beside Exchange or Microsoft 365 and rebuilds the whole message, incoming and outgoing: the message itself, attachments, calendar invites and the HTML body with its styling.
Glasswall HaloEmail relay
See the email relay
Citizen, Customer, and Partner File Intake
Citizens, customers, and third parties upload files straight into your case-management and claims systems. Every file is rebuilt before it lands, so case and records systems never touch file-borne malware.
Integration APIsCase study: EU bank KYC portal
Upload portal guide
Encrypted Document Release
Encrypted files cannot be read, so they cannot be rebuilt and are held instead. The recipient signs in with Microsoft 365 or any OpenID Connect (OIDC) identity provider, types the password once, and receives a rebuilt copy. Each release link works only once.
Glasswall HaloPassword-protected files
See password-protected files
Digital Evidence and eDiscovery Intake
Seized media, disclosure bundles and third-party productions are rebuilt before they enter evidence stores and review platforms, so investigators open every exhibit safely and case systems stay clean.
Glasswall GenesisData loss prevention
Talk to us
Cross-Domain and Isolated Network Transfer
Move files across classification boundaries, mission enclaves, and disconnected networks. Each file is rebuilt to a known-good standard at the boundary, with the same outcome every time, so nothing untrusted crosses on the strength of a detection verdict.
Glasswall GenesisCase study: petabyte cross-domainCase study: RTB-compliant lab
Cross-domain solutions
Removable Media and Kiosk Ingest
Files arriving on USB drives, discs and unmanaged laptops are rebuilt at a kiosk or transfer station before they cross into the trusted network. Standard practice for plant floors, vessels, field sites and visitor media.
Glasswall HaloZero Trust KioskCDR
See the Zero Trust Kiosk
OT Removable Media Intake
Contractors and vendors bring USB sticks, SD cards and discs onto plant and critical-infrastructure sites. At the kiosk, every file goes through Glasswall Halo and your other checks, and the engineer collects what passed. One kiosk can work alone, with no network connection.
Glasswall HaloZero Trust Kiosk
See the Zero Trust Kiosk
Offline and DDIL Operations
Glasswall Genesis runs as a self-contained binary at the tactical edge: rebuild files in disconnected, degraded, intermittent or low-bandwidth environments, with no cloud dependency and nothing to install but one file.
Glasswall GenesisDDIL
DDIL briefing
OT and Industrial File Ingest
Vendor updates, configuration files and engineering documents are rebuilt before they reach OT and ICS environments, whether they arrive over a diode, through a transfer zone or on removable media.
Glasswall GenesisGlasswall Meteor
See integration paths
Vendor Patch and Installer Assurance
Vendor patches and installers for OT and critical systems are trusted because of who signed them, not rebuilt. The publisher's signature and your approved file lists are checked, any deny blocks the file, and a file on no list is unknown, never approved.
Glasswall HaloSigned software verification
See signed software verification
Large Archive and Disk Image Intake
Engineering bundles and disc images can be too large or too deeply nested to check in one go. Nested ZIP and ISO files are opened, every file inside is rebuilt, and the container is rebuilt with a tamper-evident manifest of what happened to each file.
Glasswall HaloLarge archive processing
See large archive processing
Supply Chain File Risk
Files from suppliers, contractors and managed providers arrive with implicit trust they have not earned. Rebuild every inbound document, archive and installer to a known-good standard before it enters your environment, whichever channel it arrives on.
CDRIntegration APIs
File threat landscape
Web Proxy Download Protection
Some web gateways and proxies cannot pass downloads to another service for checking. A bridge becomes their next stop and sends the files to Glasswall Halo's ICAP server to be rebuilt. If Halo cannot be reached, files are blocked, not passed.
Glasswall HaloWeb gateway bridge
See the web gateway bridge
Repository Remediation After Incidents or Migration
After a breach, a merger, a cloud migration, or an audit finding, you inherit years of files no scanner ever cleared. Run Glasswall CDR as a scheduled job across your storage: every document, spreadsheet, and archive is rebuilt under the same policy as live traffic, from a single share up to multi-terabyte repositories.
Glasswall HaloCDR
Migration cleansing guide
Post-Breach Recovery
After a compromise, nothing in the estate is trusted. Rebuild mailboxes, shares and repositories before they return to service, so recovery does not reinfect the environment: verified-clean files, with per-file evidence for the incident report.
Glasswall HaloCase study: research-centre breach
Post-breach remediation
File Threat Intelligence and Triage
AI-powered threat prediction scores file risk from structure, not signatures, and runs on your own infrastructure, so no files leave your network. Glasswall reports a 0.015% false-positive rate for PDFs, giving analysts a triage signal they can act on.
Glasswall HaloAI-powered threat prediction
See AI-powered threat prediction
Multi-Engine Malware Consensus
One anti-virus engine can miss what another catches. Send each file to engines from different vendors at once, alongside CDR, and release it only when every one reports it clean. Signed signature bundles keep air-gapped sites current.
Glasswall HaloMulti-AV scanning
See multi-AV scanning
AI-Generated Malware Defence
AI writes new malware variants faster than signatures can chase them. CDR does not chase: every file is rebuilt to its known-good specification, so polymorphic and machine-generated threats are removed by construction, and AI-powered threat prediction flags high-risk files before any detection exists.
CDRAI-powered threat prediction
File threat landscape
Controlled Macros in Business Workbooks
Some teams cannot simply strip macros from the workbooks and templates they depend on. Each macro your policy keeps is analysed without being run, and the file is blocked, flagged, allowed or cleaned, with the findings behind the verdict.
Glasswall HaloMacro analysis
See macro analysis
Safe File Ingestion for AI Platforms
Documents feeding copilots, RAG indexes and model training are an attack path: hidden payloads, macros and embedded objects ride in on files. Rebuild every document to a clean, predictable form before your AI platform ingests it.
Integration APIsGlasswall Genesis
Discuss AI pipelines
AI Assistant and LLM Input Protection
Text from people you do not control can carry planted instructions. Check each prompt before your application sends it to a copilot or chatbot model, and get one of three verdicts. English only, up to 512 tokens per request, with a separate Pulsar licence.
Glasswall HaloPrompt injection detection
See prompt injection detection
Steganography and Hidden Data
Data hidden inside images and documents defeats inspection because there is nothing to detect. Rebuilding every image and file to a clean form destroys steganographic payloads in both directions: malware smuggled in, and sensitive data smuggled out.
CDRGlasswall Halo
Steganography brief
QR Code Threats (Quishing)
Quishing campaigns hide malicious links inside QR codes in attachments, where link scanners cannot follow them. Glasswall detects QR codes in documents and removes or flags them under policy before the file is delivered.
CDRGlasswall Halo
QR threat brief
Service Provider and OEM Platforms
Cloud and managed service providers embed Glasswall CDR into their own platforms, offering clean-file processing as a service to every tenant. Genesis ships as one self-contained binary, built for OEM integration into products, pipelines and customer offerings.
Glasswall GenesisOEM
CSP case study
File Policy Telemetry and Audit Evidence
Export processing volumes, policy outcomes, and rebuild rates as the reports your audit and assurance teams ask for: evidence that the control ran, and what it did, on every file.
Glasswall HaloCompliance evidence
See monitoring and SIEM integration
SOC Visibility into File Processing
Halo's logs, traces and metrics reach the SIEM and dashboards your SOC already uses, in one format, with passwords and other secrets removed first. Grafana, Splunk, Microsoft Sentinel, Datadog and IBM QRadar are supported, or any tool that accepts OpenTelemetry (OTLP).
Glasswall HaloMonitoring and SIEM integration
See monitoring and SIEM integration
Glasswall GenesisCDR Tool
Glasswall HaloServer
Glasswall MeteorDesktop
