Genesis, and the formats on the exception list

Glasswall's previous engine rebuilt the everyday formats natively. Genesis, released on 17 August, brings the same rebuild to 140+ file extensions, in their own formats, and up to twice as fast. The numbers are the least interesting part of that sentence.

Two meanings of "supported"

Start with what "supports a file type" means, because it means two different things and only one of them is a control.

The first is recognising the format and doing something with it: flattening it to a picture, stripping what looks dangerous, or passing it because it looked fine. Plenty of tools have done that for years, across long lists of file types.

The second is taking the file apart, validating every structure against the manufacturer's published specification, and manufacturing a new file from that intermediate representation, in the same format it arrived in. The original never passes through. That is a rebuild, and it is the only version of "supported" that changes what reaches the user.

The exception list

Every file control has an exception list, written down or not: the CAD drawing, the geospatial imagery, the DICOM study, the executable, each routed around the control because the control could not rebuild it. Nobody calls it that. It is a mailbox rule, a shared folder that skips the gateway, a standing instruction that engineering files go straight to engineering.

Flattening never closed that gap, even where it was offered. The problem with a picture of a file is not that nobody can read it; a model will read the numbers off a photo of a spreadsheet today. It is that a picture is not a working file. The formulas, the geometry, the layers, the coordinates, the metadata a downstream system needs are gone, so it cannot go back into the workflow, and the original gets requested outside the control. The control that made the file safe also made the work manual, and only one of those goes into the report.

What Genesis brings

What Genesis brings is that rebuild, same mechanism, to the formats that carry the specialist work. From Glasswall's published coverage: NITF and SIDD imagery, DWG, DXF and STEP AP242, DICOM, PE, ELF, Mach-O and Windows shortcuts, email with nested attachments, audio and video, structured data and web formats, alongside the everyday documents. Each rebuilt in its native format, with CMYK-accurate images, embedded fonts intact and coordinates untouched.

That is what makes an exception list shorter: not a policy decision, a control that reaches further.

Two things about it matter more than the coverage.

No shortcuts. Every format is fully processed and rebuilt, and nesting is followed all the way down rather than to whatever depth the clock allowed. An image inside a document inside an email meets policy on its own terms instead of inheriting trust from its wrapper. Every depth limit in this industry began as an engineering compromise and quietly became a policy, which the other side reads as an instruction: put it one level below wherever they stopped.

Speed. Glasswall reports up to 2x faster processing than its previous engine, which was already quick. That sounds like a footnote and is not. Latency is why inline controls get moved to monitor-only, skipped for large files, or handed a depth limit in the first place. A control fast enough to run on everything is a control that runs on everything.

Underneath, the engine is written in managed .NET and compiled as a self-contained Native AOT binary, which narrows the memory-corruption exposure that comes with parsing hostile files, and it runs on Windows, Linux and macOS, in a container, at the tactical edge or fully air-gapped, with no dependency on signature or reputation services. Every rule carries structured provenance, the published specification, the CVE or advisory it traces to, and reporting shows what was found, what was done and the state the file was in when it left.

The question for whoever signs off the boundary

Which formats are on your exception list today, and were they put there because they are safe, or because nothing you had could rebuild them?

Where Genesis, Halo and Meteor each fit is on our products page. For the file-handling obligations that make the exception list an audit question in Singapore, see the Singapore compliance page.