- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Menlo File Security
Invoices, CVs, claims and drawings arrive from strangers every day. None of them should be trusted as sent — Menlo File Security takes every incoming file apart and rebuilds it from known-safe content — across mail, upload portals, shared drives, S3 and SFTP — using the Positive Selection engine from Votiro.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Menlo Security platform family
This page covers Menlo File Security — the CDR add-on built on Votiro’s engine. The rest:
Quick facts
30-second orientation- Product
- Content disarm and reconstruction that rebuilds each file before it reaches a user or a bucket
- Maker
- Menlo Security, Mountain View, California; private, CEO Bill Robbins since February 2026
- Origin
- Votiro’s Positive Selection engine, acquired by Menlo on 19 February 2025
- Price
- Quote only; Menlo’s EchoQuote tool gives a budgetary estimate, and no marketplace price applies
- Licence
- An add-on to the Menlo platform, priced on products deployed and user licences
- Formats
- 220+ file types, including archives, password-protected files and files with macros
- Channels
- Email attachments, web downloads, portal uploads, collaboration sharing, AWS S3 and an open API
- Deployment
- Cloud by default and agentless; Menlo says on-premises installation is available on request
- India
- Menlo Security India LLP in Bengaluru; RAH Infotech distributes; logging is listed as Global
- In India via
- TechBag — channel mapping, a quote in INR with GST, and a side-by-side file test
Understand file sanitisation before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is content disarm and reconstruction?
CDR rebuilds every file from safe parts instead of guessing whether it is malicious.
Scan, sandbox and hope vs rebuilding every file — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Scan, sandbox and hope | Menlo File Security |
|---|---|---|
| A brand-new exploit | Missed until a signature exists | Removed, because only known-safe content is kept |
| User waiting time | Minutes while a sandbox detonates | Milliseconds, by Menlo’s account |
| Password-protected ZIP | Passed through or blocked outright | Opened, disarmed and rebuilt |
| Macro-heavy workbook | Flattened to PDF or quarantined | Rebuilt with macros still working |
| Upload portals and S3 | Usually no inspection at all | Same rebuild step as email and web |
| What it is NOT | — | A phishing filter, link scanner or published price |
The cheapest test is your own hardest files: run real macro workbooks and protected archives through it and open what comes back.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Intake
Files arrive from email gateways, Teams, OneDrive, Box, SharePoint or Google Drive, S3 buckets, FTP, SFTP or SMB shares, or your own application through the open API.
Pre-check
Before rebuilding, each file gets an antivirus pass and a hash check that Menlo calls near-instantaneous, so known-bad files are flagged and logged on the way in.
Rebuild
The engine assumes the file is malicious, pulls out only the content it recognises as safe and builds a fresh file in the same format, keeping macros, templates and layout working.
Analytics
Reports show each file’s type and origin, what was removed, hashes, names and behavioural indicators, plus recurring campaigns and the users they keep targeting.
Connectors and an API feed one cloud engine — a fast antivirus check, then every file rebuilt from known-safe parts.
Nine capabilities. Rebuild, reach, report.
Menlo File Security rebuilds every outside file from safe parts before anyone opens it, wherever it arrives.
Rebuilt, not scanned
Every file is treated as hostile and remade from safe elements, so an unknown exploit is dropped without needing a signature.
Macros that still work
Menlo says rebuilt files keep their macros, templates and formatting, so a finance workbook stays usable after disarming.
Archives and passwords
ZIP and RAR archives, password-protected files, AutoCAD drawings, audio and video sit among the 220+ supported types.
Attachments disarmed
Attachments are cleaned as mail passes through an email gateway, so a weaponised invoice arrives as a harmless copy.
Portals that take files
Files customers or vendors upload through web portals are rebuilt before your staff or back-office systems open them.
S3 and shared drives
Objects landing in AWS S3, and files shared in Teams, OneDrive, Box, SharePoint or Google Drive, are sanitised as they arrive.
FTP, SFTP and SMB
Connectors for FTP, FTPS, SFTP and SMB put the rebuild step in file-transfer paths that never touch a browser or mailbox.
What was stripped out
Reports list the malicious content removed, with hashes, file names and behavioural indicators for each sanitised file.
Who keeps being targeted
Recurring campaigns and the users they aim at are surfaced, which turns silent file disarming into a list to act on.
Watch Menlo on file-borne threats
Two official Menlo explainers on file-borne ransomware, both recorded before the Votiro acquisition; Menlo hosts its CDR demo on Vimeo.
Protection from sophisticated ransomware threats with Menlo Security
Menlo on file-borne ransomware, recorded a year before the Votiro deal; not a demo of the current CDR engine.
Two minutes on: Ransomware prevention
A two-minute primer on how ransomware gets in, useful background for why a file is rebuilt rather than trusted.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Detection waits to recognise a threat. Menlo File Security rebuilds the file instead.
Here’s what genuinely sets it apart — and exactly where it stops.
No signature, no waiting for one
Scanners and sandboxes must recognise something bad before they act, and a new exploit is not yet recognised. Positive Selection works the other way: it keeps only the parts of a file it knows are safe and builds a new copy, so a zero-day hidden in a macro or PDF object never arrives.
One engine for every route a file takes
One rebuild step serves email attachments, downloads, portal uploads, Teams, OneDrive, Box, SharePoint, Google Drive, S3 and FTP, SFTP or SMB transfers, with an open API for the rest. It is sold beyond Menlo’s browser, so it can guard an upload portal with no Menlo proxy in the path.
Files that still open and still work
Flattening a document to PDF or an image makes it safe but breaks spreadsheets and forms. Menlo says its rebuilt files keep macros, templates and formatting, arrive in milliseconds, and include archives and password-protected files, so users get the file they asked for.
Where it stops
No public price and no analyst ranking. The File Security processing region is unpublished and logging is listed as Global, so Indian residency is a contract question. It disarms files only: no phishing-text filtering, no link scanning, no gateway replacement, and both videos predate Votiro.
The numbers behind the platform
What your Menlo File Security rollout looks like
Map every way files get in
List mail, upload portals, S3 buckets, shared drives and SFTP feeds, with rough daily volumes and who opens the files.
Collect the awkward files
Gather real macro workbooks, CAD drawings and password-protected archives your teams rely on, to test rebuild fidelity.
Pilot one channel
Connect a single route, such as a customer-upload portal or one S3 bucket, and compare rebuilt files against originals.
Add mail and shared drives
Extend to email attachments and Teams, OneDrive or SharePoint, and agree how users ask for an original when needed.
Wire reports to the SOC
Route the stripped-content reports to your security team and review which users recurring campaigns keep reaching.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Loan applicants upload salary slips and bank statements to our portal. Every PDF is rebuilt first, and underwriters stopped asking whether a file is safe.”
“Our costing team lives in macro-heavy Excel from suppliers. The rebuilt workbooks still calculate, which was the test the last tool failed.”
“We put it on the S3 bucket our partners drop claims into. Nothing reaches the processing job until it has been remade.”
“Password-protected ZIPs used to sail past our gateway. Now they get opened, disarmed and repacked before anyone sees them.”
“The campaign report showed one vendor-payments clerk was hit by the same lure for weeks. That changed our training plan.”
“It works, but there is no price to budget against. We used EchoQuote for a rough figure and still waited on the real quote.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the file sanitisation market — tap any vendor to see why it sits where it does.
TechBag File Sanitisation Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Votiro engine under Menlo since 2025; quote only.
Channel Reach × Rebuild Depth
The grid nobody publishes — how many routes into the business it covers vs how thoroughly it rebuilds the files it touches.
220+ types rebuilt; mail, web, S3, collab and SFTP.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Menlo File Security vs the file sanitisation field
Against OPSWAT MetaDefender, Glasswall Halo, Check Point Harmony Email & Collaboration, Microsoft Defender for Office 365 and Fortinet FortiMail — on method, file types, channels, price, India and exit.
| Dimension | Menlo File Security | OPSWAT MetaDefender | Glasswall Halo | Check Point Harmony Email & Collaboration | Microsoft Defender for Office 365 | Fortinet FortiMail |
|---|---|---|---|---|---|---|
| What it is | Standalone CDR service | Multi-engine platform | Dedicated CDR engine | Email suite with CDR | Sandbox, not CDR | Email gateway with CDR |
| Deployment | Cloud; on-prem on ask | Cloud, AWS AMI, on-prem | Kubernetes, OVA, AMI | SaaS via API | Inside Microsoft 365 | Appliance, VM or cloud |
| File coverage | 220+ file types | 200+ types to rebuild | 85+ formats | Office, PDF, images | Detonates, no rebuild | Office and PDF disarm |
| Channels covered | Mail, web, S3, shares | Web, mail, storage | API and desktop | Mail and collab apps | Microsoft 365 only | Email only |
| Pricing model | Per user, add-on | By request volume | Licence from vendor | Per user per month | Per user per month | Appliance or per user |
| Published entry price | Not published | $55,000 a year (AWS) | Not published | Quote only | $2 per user a month | Quote only |
| Included vs add-on | Bought on top | Engines count apart | CDR is the product | Beside sandboxing | In Business Premium | Sandbox sold apart |
| Speed and scale | Milliseconds (claim) | Milliseconds (claim) | Sized by you | Clean copy at once | Message first | Per appliance model |
| Method and depth | Rebuild every file | Rebuild plus AV | Rebuild to standard | Strip or convert | Detection only | Strip active content |
| Integrations | Collab, S3, transfers | ICAP and storage | REST API, Helm | M365 and Google | Microsoft only | Fortinet fabric |
| India data location | Not published | Your servers | Your servers | Ask for region | Tenant geography | Appliance on-site |
| Support | Basic + Care360 | Not published | Not published | Partner and vendor | With the subscription | FortiCare contracts |
| Lock-in and exit | Standard files out | Runs on your hosts | Containers you own | Tied to the tenant | Tied to Microsoft 365 | Gateway in mail path |
| Best fit | Many routes, one CDR | Air-gapped, multi-engine | Build it into apps | Harmony email buyers | Microsoft-only estates | Fortinet mail estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Menlo File Security if…
- ✓Files reach you through several routes — mail, upload portals, S3, shared drives, SFTP — and you want one rebuild engine on all of them
- ✓Users depend on macro-heavy spreadsheets or password-protected archives that flattening or blocking would break
- ✓You already run Menlo’s cloud browser and want downloads and uploads rebuilt by the same vendor
Compare alternatives if…
- ✓You need CDR on servers in an air-gapped network — OPSWAT MetaDefender Core and Glasswall Halo both install on-premises by design
- ✓Your only file route is Microsoft 365 mail — Defender for Office 365 may already be in the licence you hold
- ✓You want a published price before talking to sales — Defender lists per-user rates, and OPSWAT has an AWS listing
Do not expect…
- ✓A public price, a marketplace listing or a free trial for File Security
- ✓A phishing filter, link rewriting or a replacement for your email gateway
- ✓A published Indian processing region; Menlo lists its logging as Global
TechBag has no file sanitisation (CDR) guide yet, so Menlo File Security sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What do risky outside files cost you?
Drag the sliders (staff who open files from outside; security-team hour cost). Estimates model security and IT time spent on suspicious-attachment triage, quarantine releases and clean-up after a malicious file is opened, at an assumed 1.5 hours per such employee a year, with 70% of it removed by rebuilding files before they arrive. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: Menlo prices by the products deployed and the number of user licences, and sells File Security as an add-on. Its EchoQuote tool gives a budgetary estimate; no marketplace price applies to this product. TechBag maps your file routes first, then gets the quote in INR with GST.
One channel first
Best for an upload portal or S3 pilot
- One route connected through the API
- Rebuilt files checked against originals
- Quote on request; no public price
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Every file route
Best for regulated, file-heavy teams
- Mail, collaboration, storage and SFTP
- Threat reports routed to the SOC
- On-premises option on request
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which routes carry outside files today — mail, portals, S3, shared drives, SFTP — and which will you connect first?
Do rebuilt copies of your own macro workbooks, CAD files and protected archives open and behave like the originals?
When a user needs the untouched original, who approves the release, and how is that request logged?
Where in the Menlo Cloud will files be processed, and will Menlo write that into the contract for India?
Logging is listed as Global; how will you export logs to a SIEM to hold CERT-In’s 180 days in India?
Do any channels need the on-premises option Menlo offers on request, and what does that change in the quote?
Which sandbox or gateway features in your current licences already touch these files, and what can retire?
Is File Security quoted as an add-on per user, and what users or volumes does it count? Ask for INR with GST.
Questions buyers ask
Ready to evaluate Menlo File Security?
List the routes outside files take into your business, or let a TechBag advisor scope a pilot on the one channel that worries you most.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.