File Inspection
Every file Shield handles — an attachment uploaded through the API, a file attached to an SMS, WhatsApp, or email message during antispam/antiphishing inspection, or a file downloaded while investigating a suspicious link — is checked for malware before anyone in your organization or your customers can open it.
How it works
File inspection runs inside a fully isolated environment, purpose-built for handling untrusted content safely. Nothing about the file's raw contents is ever exposed outside that isolated environment — only a verdict comes back.
- Fingerprint and reputation. Shield calculates a unique fingerprint for the file and checks it against a large, continuously updated body of known-malware intelligence. If the fingerprint is already known to be malicious (or already known to be safe), the verdict comes back instantly.
- Signature and heuristic scan. If the file is unfamiliar, Shield inspects its structure and contents for the hallmarks of malicious files — mismatched file types, unusual internal structure, embedded macros, disguised extensions, and other known danger signals — and compares it against a library of malware signatures.
- Deep analysis (Premium). For files that are still ambiguous, Premium tenants get a deeper look: a full antivirus-grade scan plus sandboxed file analysis, which safely observes what the file actually does when opened, without ever letting it run anywhere near your real systems or data.
At every step, once Shield reaches a confident verdict the file is classified and the result is remembered, so the next time anyone encounters that exact same file the answer comes back instantly.
Plans
| Plan | What's included |
|---|---|
| Basic | Fingerprint and reputation check + signature and heuristic scan for every file. |
| Premium | Everything in Basic, plus a deep antivirus-grade scan and sandboxed file analysis for files that need the deepest look. |
Monthly file-scan cap
Deep file analysis is the most resource-intensive check Shield performs, so each Premium tenant has a configurable monthly cap on how many files can go through deep analysis. Your cap is set for your account and can be adjusted on request.
If your tenant reaches its monthly cap, Shield doesn't stop inspecting files — it simply falls back to fingerprint/reputation and signature/heuristic scanning (the same protection every Basic plan gets) for the rest of the month, and resumes deep analysis the following month.
What you'll see
- Inside the portal, a file that's still going through deep analysis shows a brief loading indicator while the result comes back — most checks resolve in a matter of seconds.
- Every verdict — clean, suspicious, or malicious — is shown with a plain-language classification, not raw technical data.
- Files themselves are never stored or displayed by Shield; only the verdict and a fingerprint used for future lookups are retained.
Powered by ROUNDBOX Orbis Labs
All file safety verdicts are produced by ROUNDBOX Orbis Labs, the analysis engine behind every ROUNDBOX Orbis Shield module. Classifications are normalized to a consistent risk scale across every product surface, so a "malicious" verdict means the same thing whether it came from an API call, a message attachment, or a portal search.
See also: Shield API overview for how to submit files directly from your own systems, and URL Analysis & Web Sandbox for how Shield handles links, including files downloaded while investigating a suspicious link.