Signature
Antivirus- What it checks
- Does this match malware we have seen before?
- How AI defeats it
- Mass-produce variants
- At 10,000 variants
- Anything unlearned passes through
Since 2015 · A decade focused on CDR
Document threats,
Document threats,
neutralized at the
binary level.
Our MARS engine reverse-engineers every document at the binary level to surface hidden threats. CDR then strips out malicious components and rebuilds a clean file—preserving the original layout and content. The same Detect+CDR architecture protects every content entry point: network gateways, email, and cloud.
MARS ENGINE REVERSE ENGINEERING AI-DRIVEN ATTACKS SLF · SLE · SLCDR · ConTI ENTERPRISE READY
AI-DRIVEN ATTACKS · WHY NOW AI that evades detection.
AI that evades detection.
A defense with no detection to evade.
AI finds unknown document vulnerabilities on its own and mass-produces variants built to slip past detection. SecuLetter does not judge whether a file is malicious. It disassembles the structure at the assembly level, removes what makes the vulnerability exploitable, and rebuilds the file. One variant or a hundred thousand — the result is the same.
When AI generates 10,000 variants
Behavior-based
Sandbox · APT- What it checks
- Does it misbehave when executed?
- How AI defeats it
- Delay execution and stay quiet when it detects an analysis environment
- At 10,000 variants
- One evasion routine and all of them pass
SecuLetter
Structural analysis + CDR- What it checks
- Does the file structure contain what makes a vulnerability exploitable?
- How AI defeats it
- Nothing to evade — it neither executes nor judges
- At 10,000 variants
- Identical regardless of count
WHY SECULETTER · THREE REASONS ENTERPRISES CHOOSE US Stop the threats your existing security can't see—
Stop the threats your existing security can't see—
non-executable document attacks, neutralized at the source.
Technical foundation, threat coverage, and enterprise-grade credentials—three reasons SecuLetter is the right choice for content security.
PRINCIPLE · HOW
MARS ENGINE
Disassemble. Analyze. Reassemble safely.
MARS reverse-engineers every document at the binary level to expose hidden threats—malicious macros, embedded OLE objects, weaponized fonts. CDR then strips out the risk elements and rebuilds a clean, functional file. Even signatureless zero-days can't execute when they've been structurally removed.
- Underlying technology
- MARS (Malware Analysis & Reverse-engineering System) engine—a reverse-engineering-based Detect+CDR architecture.
- Key difference
- Detection-based tools (antivirus, sandboxing) only catch what they've already seen. MARS analyzes file structure itself—neutralizing zero-day threats based on what they are, not what they look like.
- Measured performance
- Independently benchmarked at 12.02s average analysis and 34ms average sanitization across 200,000 real-world files.
COVERAGE · WHAT
309+ FORMATS
We don't replace your stack. We close its blind spot.
Antivirus and sandboxing handle executable files well. The blind spot is non-executable documents—Word, Excel, PDF, images, and HWP. The majority of attacks against regulated industries arrive through these formats. SecuLetter exists to close that gap.
- Supported formats
- 309+ formats across the CFB and OOXML families—Microsoft Office (all generations), PDF 1.4 through 2.0, image steganography detection, and HWP 5.0/2018.
- Integration
- Deploys as a gateway in front of existing antivirus, sandbox, and DLP infrastructure. Adds missing coverage without disrupting policies or replacing hardware.
- Field result
- Q3 2024: At a government agency, SecuLetter intercepted four malware droppers that had bypassed the incumbent sandbox. Document-borne incidents at that site since deployment: zero.
EVIDENCE · WHY
AUDIT READY
Audit-ready evidence, on day one.
Enterprise security buyers face a common pressure—"adopt this solution, and don't get flagged in audit." Insufficient evidence directly affects performance reviews and budget approvals. SecuLetter provides documentation that drops straight into audit, procurement, and security review.
- Independent certifications
- Common Criteria EAL2 · ISO 27001 · GS Grade 1 (TTA) · featured in Gartner research as a CDR vendor.
- Peer references
- National ministries, pension funds, defense contractors, and major financial institutions—100+ enterprise organizations in production. The strongest approval pathway is peer adoption at scale.
- Migration case
- In 2024, a major defense contractor migrated from a foreign CDR product to SecuLetter. Cited reasons: native format coverage, local-language audit documentation, and regional support response times.
Solutions
Every content path. One engine.
The same MARS engine secures both the file path (SLF) and email path (SLE). Add CDR sanitization (SLCDR) and threat intelligence (ConTI) as shared modules wherever you need them.
FILE · SLF
File security gateway
Cross-network file transfer, document repositories, and web upload portals. 309+ formats reassembled at the structural level.
EMAIL · SLE
Email security (DISARM)
Attachment sanitization, URL rewriting, and content verification before delivery. Deploys in front of your existing email gateway with no infrastructure changes.
DEPLOYMENT PATHS · WHERE WE PROTECT
Protect every path content takes into your enterprise
Two primary content paths—file and email—both protected by the same MARS engine. Add modules wherever you need them.
PATH 01 · FILE
File security path
Cross-network file transfer, document repositories, public upload portals, financial and government internal networks, defense secure networks, manufacturing and energy OT systems, and secure development environments.
SLF
File security gateway
+SLCDR
Sanitization module
+ConTI
Threat intelligence
- Throughput
- 49,000–315,000 files per day (hardware-dependent)
- Reference deployments
- National health insurance · major brokerage
- Deployment
- On-premises appliance
PATH 02 · EMAIL
Email security path
Inline deployment in front of your mail server (on-premises) or API integration with Microsoft 365 and Google Workspace (cloud). Attachments and links analyzed in parallel before delivery.
SLE
On-premises email gateway
DISARM
Cloud API
+ConTI
Threat intelligence
- Throughput
- 160,000–912,000 messages per day
- Reference deployments
- Major defense contractor · major investment firm
- Deployment
- On-premises appliance · cloud deploys in minutes
+ Add-on modules — Layer CDR sanitization (SLCDR) and threat intelligence (ConTI) onto any path. These attach to your deployment rather than being sold as standalone categories.
SLCDR ConTI
DEPLOYMENT · ARCHITECTURE
One MARS engine. Every entry point.
Network gateways, email, web portals, and document repositories—different paths, all protected by the same engine.
DEPLOYMENT · ARCHITECTURE 1600 × 900 · 16:9 · PNG /images/deployment-arch.png
Email gateway SLE
Inbound email attachments and embedded URLs analyzed by MARS on arrival. Deploys inline, downstream of your existing spam filter.
Cross-network file transfer SLF
Every file inspected before crossing from the external to the internal network. Integrates via SMB, NFS, and SFTP APIs.
Public web portals SLF
API integration with public-service portals, procurement systems, and web applications. Async polling-to-callback architecture minimizes server load.
Document repository SLF
CDR sanitization runs before files are stored. Malicious files are quarantined; only clean files reach the repository.
HOW IT WORKS · TWO TECHNIQUES COMBINED
Reverse-engineering analysis + CDR sanitization
MARS is the analysis engine; SLCDR is the sanitization engine. We're one of the few cybersecurity vendors that built both in-house.
Background · three blind spots in legacy security
Sandboxes need observable runtime behavior to classify a threat. Attacks engineered without runtime behavior are undetectable by definition.
01
Reverse-engineering analysis MARS ENGINE
Disassembles file structure at the binary level—without executing the file. Surfaces structural anomalies even when no known signature exists.
02
Threat identification
Identifies risk elements: malicious macros, scripts, embedded OLE objects, weaponized links, and external template references.
03
CDR sanitization SLCDR
Removes the risk elements, then reassembles the file while preserving the original layout, comments, and link structure.
04
Safe delivery
Delivers the verified, clean file to the recipient. End-user experience is identical to the original.
If a sandbox is watching the security camera footage,
MARS is identifying suspects by fingerprint and DNA.
12.02sAverage MARS analysis time
34msAverage CDR sanitization per file
309+Supported file formats
Read the full technical overview → CUSTOMERS · ENTERPRISE DEPLOYMENTS
100+ organizations protected by SecuLetter every day
Government, finance, defense, and manufacturing—a partial list of named, in-production references. Contact your account team for the full list.
NHIS 
NPS 
KISA 
KEPCO 
Korea Post 
KOTRA 
KOICA 
KETEP 
MSIT 
MOTIE 
MCST 
KAMCO 
KB Securities 
Korea Investment & Securities 
Daishin Securities 
BNK Busan Bank 
DB Insurance 
eBEST Investment & Securities 
KSD 
LIG Nex1 
HD Hyundai Oilbank 
Samsung Electronics Sales 
Seoul Semiconductor CASE STUDIES · PRODUCTION DEPLOYMENTS Ten named enterprises.
Ten named enterprises.
Same engine. Different environments.
Government, finance, defense, and education. Adoption triggers and operational outcomes—the kind of detail you can quote directly into audit, internal approval, or RFP review.
BNK Busan Bank
Behavior-based security couldn't catch threats hidden in non-executable documents.
- Malware detected across both network gateway and email paths
- Unified monitoring platform via API integration
National Health Insurance Service
Malware infiltrating through the public-service portal's file upload path.
- 5x faster file analysis in head-to-head testing
- Public-service portal protected with no impact on workflow speed
Korea Internet & Security Agency
Air-gapped network security required for sensitive systems.
- High detection rate, fast analysis, no file-size limits
- Real-time threat blocking with no operational delay
LIG Nex1
Sophisticated email-spoofing attacks. Replaced an incumbent behavior-based solution from a foreign vendor.
- Malware and malicious URLs detected at the network gateway
- Email-attachment document attacks stopped at the source
Korea Electric Power Corporation
Incumbent security couldn't detect document-based ransomware.
- 20,000+ accurate threat detections per day
- Closed the coverage gap left by the existing spam filter
Korea Investment & Securities
Surge in document-based malware drove the need for a Common Criteria-certified solution.
- Email-path malware and phishing URLs blocked
- Email path scaled with high-availability redundancy
Korea Post Information Center
Cross-network transfer of regulatory PDF filings hit detection-rate and throughput limits.
- Every regulatory PDF fully analyzed
- No workflow delays at peak transfer volumes
Korea Institute of Energy Technology Evaluation and Planning
Increase in non-executable file attacks targeting remote-work environments.
- Malware blocked before files reach the document repository
- Remote-work environment hardened
Daishin Securities
Behavior-based solution had high latency and missed evasive attacks.
- High detection rate regardless of file size
- Cross-network transfers protected with no added latency
Joongbu University
Email-spoofing malware exceeded the existing spam filter's detection capability.
- Known and zero-day malware detected
- Phishing-URL injection attacks blocked
CERTIFICATIONS · AWARDS · PROCUREMENT
View all certifications → Audit-ready evidence, ready to drop into your approval workflow
KISA Certified
100% APT detection rate
TTA GS Grade 1
12.02s avg · 200k files
Common Criteria
EAL2 assurance
Government procurement
Listed on Korea's e-procurement system
Gartner
Featured email security vendor
ISO 27001
Information security management
CDR Patents
Industry-leading portfolio
POC · BENCHMARK READY IN 3 DAYS Document security.
Document security.
See it for yourself.
Run a benchmark with your own files and samples. Deploys inline without changes to your existing infrastructure—results report typically within 3 days.
NDA upfront Government procurement approved Deployed across national ministries Common Criteria EAL2 certified