Handle Encrypted Files Your Scanner Cannot Check
An encrypted attachment your scanner cannot inspect is not a clean file. Use a controlled hold, verify the sender, and arrange authorized review.
On this page (10 sections)▼
When a scanner cannot inspect an encrypted attachment, keep the file held until an authorized process resolves the visibility gap. “Encrypted,” “skipped,” or “unable to scan” does not mean “no threat.” Encryption can protect a legitimate document while also preventing a security tool from seeing its contents.
Do not delete every protected file automatically, and do not open every protected file because it has a password. Instead, establish whether the delivery is legitimate, whether the content is needed, and where an authorized reviewer can inspect it. This guide is about managing the exception, rather than teaching a normal PDF scan or creating an encrypted archive.
Name the gap accurately
Begin with the actual scanner message. Did it say the archive was encrypted, a member was inaccessible, the format was unsupported, or processing timed out? Those conditions lead to different next actions. An unsupported compression method may require a different approved application; an encrypted file requires an authorized way to inspect its content.
Record the file’s identity and the inspection limit together. A note saying “scanner passed” is misleading if only the container was inspected. A better note says “container screened; encrypted members not assessed,” with the relevant tool result attached or referenced.
Encryption is a confidentiality mechanism, not a statement about sender legitimacy. The same protected delivery format can be used for useful records, mistaken content, or hostile attachments. Its business explanation should therefore be checked independently of its technical format.
| Outcome | Meaning for the review | Status to record |
|---|---|---|
| Encrypted members inaccessible | The tool lacked usable visibility | Held pending authorized inspection |
| Unsupported archive method | Tool compatibility limited review | Held pending supported processing |
| Scan interrupted | Result is incomplete | Held pending completed screening |
| Detection in visible content | An actionable concern exists | Security review required |
| Completed review of decrypted copy | Evidence applies to that copy | Decision based on full review scope |
Do not invent a green status just because your tracking system lacks an “uninspected” option. Add a plain-language note and assign an owner who can make the next decision.
Create a controlled hold
Store the received file in the location your security workflow uses for pending attachments. Restrict access to the people who need to assess it. Do not place it into the normal client folder, where another user may open it without knowing a check failed.
A hold is not necessarily the antivirus product’s quarantine feature. Depending on the system, it may be a controlled folder, a gateway hold, or an internal review ticket. Use the term your organization defines so users understand whether the tool blocked access or a person is merely asking them not to open it.
Avoid automatic distribution while the decision is pending. A sync folder, shared inbox, or integration may move attachments into other systems without deliberate action. Check the actual workflow and prevent onward delivery where you have authority to do so.
Preserve the original file and message reference as instructed. Do not edit the original to remove its protection merely to get a different scanner result. If authorized decryption produces a review copy, label that copy and record its relationship to the received version.
Give the hold a review owner and a business deadline. The deadline indicates urgency, not permission to bypass inspection. A clear ticket can say what is blocked, why it matters, what information is missing, and who is able to release the content.
Verify the sender and the need
Contact the sender through a previously established route when protected content is unexpected. Do not rely only on the password arriving in a second email from the same account. Two messages from one compromised mailbox do not provide independent confirmation.
Ask what the package contains, why it is encrypted, and whether that delivery method was agreed. A legitimate sender should be able to identify the business purpose without requiring you to launch the file first. Confirm the expected file types and approximate scope.
Check whether the sender can provide the necessary content through an existing approved portal. Moving the exchange to a known channel may reduce ambiguity, although the receiving workflow still needs to screen the content appropriately. Do not ask for sensitive records to be sent unprotected merely because that is easier for the scanner.
If the file is unsolicited and unnecessary, rejection may be the appropriate decision. You do not owe every sender a technical investigation. Record the basis for rejection and avoid keeping unneeded confidential material indefinitely.
For recurring partners, agree on acceptable formats and password delivery in advance. This reduces avoidable holds and makes unusual departures easier to recognize. The agreement should describe the approved processing route rather than promising that every encrypted delivery will automatically be released.
Arrange authorized inspection of the contents
Use a review environment that the security team approves for the sensitivity and threat level. The reviewer may decrypt a copy with an authorized password, inspect its contents, and apply the relevant screening. Do not instruct an ordinary recipient to disable antivirus or remove organizational controls.
The decrypted copy has its own confidentiality requirements. It should not land in a personal sync account, temporary public folder, or loosely shared ticket attachment. Decide where it will be stored, who can access it, and how it will be removed or retained after the review.
Keep the scope explicit. If the archive contains another encrypted member, the visibility gap remains for that member. A successful scan of the first layer is not equivalent to screening every file in a nested collection. If the structure is unnecessarily complex, ask for a simpler authorized package.
Microsoft’s Safe Attachments documentation illustrates a service-level attachment analysis workflow; its availability does not establish your tenant’s exact configuration or inspection coverage. Microsoft Safe Attachments documentation Ask the administrator about the result for this delivery rather than assuming a product name guarantees release.
| Review decision | When it may fit | Required handoff |
|---|---|---|
| Inspect an authorized decrypted copy | Content is needed and the environment is approved | File mapping and recorded screening result |
| Request an approved alternate delivery | Original format prevents reliable review | Sender agreement and fresh receipt check |
| Reject the package | No legitimate business need or unresolved sender concerns | Reason and retention decision |
| Escalate for specialist assessment | Suspicious behavior or complex structure | Evidence reference and named incident owner |
A fictional case: a protected financial evidence pack
A fictional finance team expects a supplier’s supporting records. The email gateway reports that an encrypted ZIP could not be fully inspected. The invoice deadline is close, and the sender includes the password in a follow-up message.
The reviewer records the inspection limit and keeps the file out of the shared payable folder. Using the supplier number already held in the vendor record, the reviewer confirms that the delivery was requested and asks for the manifest. The manifest lists two statements and a reconciliation spreadsheet, with no executable content.
The security team arranges an authorized review copy in its approved environment. During that process, the team finds an additional encrypted archive that was not listed. The supplier explains that an export tool included an old attachment and provides a simplified replacement through the agreed portal.
The team reviews the replacement, records the version mapping, and releases only the required documents. The original remains handled under the pending-file retention rule. Nobody changes the original gateway outcome from “not inspected” to “clean.” The final release refers to the replacement that was actually reviewed.
This scenario is illustrative. It shows that independent sender confirmation and technical inspection answer separate questions. The password tells the reviewer how to access content, but it does not establish that the contents are appropriate or that all layers have been assessed.
Handle urgency without erasing uncertainty
When the hold affects a deal or payment, explain the missing evidence in business terms. “The tool could not inspect the attached records” is clearer than a long discussion about encryption algorithms. Offer the sender an approved route that the reviewer can process.
A business owner may need to accept a documented exception under organizational policy. That is different from the recipient privately deciding to open the file. Any exception should identify the approved person, the reason, the known visibility limit, and the controls used to reduce exposure.
Do not make guarantees about isolated environments. Specialist review can reduce risk and improve visibility, but no single label such as sandbox means every behavior is observable or harmless. Keep the decision tied to evidence actually obtained.
If someone has already opened the file, record the time, application, and actions as accurately as possible. The response team needs to know whether content was merely listed, decrypted, viewed, or executed. Deleting the attachment afterward does not undo earlier processing.
Close the hold with a specific decision
Release, rejection, and escalation should each have a final record. State which version was processed, which contents remained inaccessible if any, and where approved material was delivered. If the final delivery is a replacement, retain the link between the replacement and the original request.
Review recurring causes of holds. If a partner repeatedly sends incompatible archives, agree on another format. If the receiving gateway reports vague outcomes, ask the administrator for a usable explanation. The goal is a repeatable exchange that preserves confidentiality and gives security controls meaningful visibility.
Train reviewers to recognize the difference between “no detection” and “not inspected.” That distinction is often more useful than asking them to understand every archive option. A concise status vocabulary prevents accidental release when a busy colleague picks up the case later.
Frequently asked questions
Should every encrypted attachment be rejected?
No. Legitimate confidential deliveries may be encrypted. Keep them held until the agreed review process provides a justified decision.
Can the sender email me the password and call it verified?
The password permits access, but it does not independently establish sender legitimacy or file safety. Confirm unexpected deliveries through an established route.
What if the tool scans the outer ZIP but skips a nested archive?
The nested content remains uninspected. Record that limit and resolve it before treating the package as fully reviewed.
Before you proceed
An unscannable encrypted file needs an accountable exception process. Preserve the original result, verify the business context, and release only the version and scope that your authorized review actually supports.
Parent guide
Related articles
Sources and editorial disclosure
Primary documentation reviewed October 13, 2026. Worked examples are fictional illustrations. Checklists and decision frameworks are editorial recommendations; product-specific facts are linked to official documentation. These guides do not claim that signed-in product tests or customer projects were performed.
VDR Directory is published by the team behind SendNow. This ownership is relevant when evaluating any product mention. Stock photos illustrate general context; they do not demonstrate software features or identify actual affected people. Controls and tool availability depend on the provider, edition, version, device and configuration. No guide guarantees confidentiality, regulatory compliance, acceptance of altered documents, or search rankings.
Related Guides & Research
Recommended next reading for deal teams and transaction leaders.
Check Before Uploading Confidential Files to AI
Use this checklist before uploading confidential files to AI. Verify authorization, processing terms, data minimization and safe handling of outputs.
Protect Confidential Files After a Laptop Is Stolen
Respond to a stolen laptop with a clear file-exposure checklist. Assess encryption, revoke account access and use only previously configured controls.
Are Online PDF Tools Safe for Confidential Files?
Decide whether an online PDF tool is suitable for confidential files by checking processing location, retention, access, terms and safer alternatives.