Secure file transfer remains a blind spot, OPSWAT executive warns in TechRadar analysis

The article, written by the senior vice president for international operations at OPSWAT, argues that file transfer is a fundamental process yet often overlooked. Every invoice sent to a supplier, every firmware update pushed to a factory floor, and every report shared with a regulator involves data crossing systems with different levels of trust, the author notes.

The piece says that for years, file transfer security was treated as a solved problem, with enterprises encrypting the channel and confirming delivery. That approach made sense when systems were simpler and threats moved more slowly, but it no longer reflects reality.

The analysis points out that most file transfer platforms were never built with security as the primary goal. They were designed to move data reliably, encrypt the connection, and confirm delivery, but whether the file itself was safe was rarely part of the equation. This leaves the process exposed to man-in-the-middle interception, credential theft, and malware covertly embedded in otherwise ordinary files.

The article references incidents such as the 2023 MoveIT supply chain cyberattack and a SharePoint breach last year to illustrate the risks. A single vulnerability in a widely used transfer tool can give attackers access to thousands of organizations at once, simply because every one of them assumed the platform itself could be trusted.

The author emphasizes that attackers now routinely exploit newly disclosed vulnerabilities within 48 hours, while detection of file-based breaches can take months. This gives intruders ample time to move laterally, extract data, and embed themselves further into connected systems before anyone realizes something is wrong.

To address this, the article recommends shifting toward a security-first managed file transfer (MFT) process, where every file, user, and workflow is treated as a potential point of exposure. This includes deep content inspection to identify hidden elements, automated vulnerability detection and malware prevention by default, and sandboxing to test potentially malicious files in an isolated environment before they reach live systems.

The article concludes that waiting to react is not a viable strategy. Proactive, layered controls around every file entering or leaving a business are more important than ever.