Why malware detection can’t stop at the endpoint in 2026

Kaspersky detected around 500,000 malicious files per day in 2025, across all environments, over the period from November 2024 to October 2025: a 7% increase on the previous year. Malicious files remain a large-scale threat that knows no borders, and they can enter an information system through many different points of entry.

Yet most organizations concentrate their security controls on email and the endpoint. Between those two, entire parts of the information system go uncovered.

GLIMPS experts review where those coverage gaps sit, and what can be done about them.

Contrary to what many assume, attackers do not need to exploit a technical flaw or steal credentials to get a malicious file into an organization. They abuse the trusted channels already in place, without ever having to break through existing defenses.

A partner drops a document into a shared SharePoint or OneDrive space. An attachment lands in an email. A contractor uploads a file to a business application. A deliverable arrives in a shared network folder. An artifact enters a development pipeline. These are everyday actions, and incoming files are assumed to be safe. A malware can sit in any of them without triggering a single alert.

Out of all these channels, most organizations genuinely protect only two: with an email security solution, and with an EDR.

An EDR observes activity on the endpoint where it is installed. It mainly reacts once a file executes and behaves suspiciously: memory injection, abnormal process, persistence attempt, outbound connection. A document sitting idle in a storage space, a file passing through a business application, a script transiting a pipeline: none of these execute, and none of them come within reach of the EDR. So how do you secure those unmonitored areas?

Inside storage spaces, files circulate from one user to the next. Someone opens a document, copies it into another folder, forwards it to a colleague. Distribution is even faster when automatic synchronization is enabled, as it typically is on Microsoft SharePoint, OneDrive or NextCloud. For as long as a file stays within the storage layer, nothing inspects it. The file server, the NAS or the cloud storage space then becomes a distribution relay.

These environments fall outside the scope of conventional controls. A storage space hosts no EDR agent and sits beyond the reach of perimeter network inspection. Files are stored, accumulate and get shared with no dedicated control, sometimes long after they were first uploaded.

Less monitored, these environments are also increasingly targeted for what they hold. In its Panorama de la cybermenace 2025, published on March 11, 2026, ANSSI (the French national cybersecurity agency) recorded 196 incidents involving data exfiltration in 2025, up from 130 in 2024: an increase of more than 50%.

Business applications and web applications receive files continuously. The examples are everywhere: a candidate uploads a resume to a recruitment portal, a supplier submits an invoice through an extranet, a policyholder attaches a document to an insurance claim, an employee adds a file to a CRM or a collaboration tool. Those documents are accepted, processed and stored by the application, then often passed on to other internal services, but almost never analyzed.

OWASP (the Open Worldwide Application Security Project) ranks file upload among the widespread, high-impact risks affecting web applications, because an accepted file can be stored, relayed to internal systems, then executed or opened. That file never went through the email gateway, the server receiving it hosts no EDR agent, and the signature-based antivirus that may be in place will let unknown code through when it is concealed inside an ordinary-looking document.

Software development rests on a principle of trust. Open source dependencies, artifacts, container images and deliverables move continuously and get integrated into production, often with no dedicated analysis. Each one is a file entering the information system through a channel considered reliable by default.

Kaspersky notes that attacks on the software supply chain, including open source software, grew sharply in 2025, most notably with the appearance of the first large-scale NPM worm, named Shai-Hulud.

A recent case shows how this works in practice. On March 24, 2026, two tampered versions of the Python library LiteLLM, used to route requests to a wide range of language model providers, were published on the PyPI registry by the TeamPCP group, which had first stolen the maintainer’s publishing credentials. Downloaded roughly 3.4 million times a day, the library distributed a malicious file for a few hours before the package was quarantined. That file harvested cloud credentials, SSH keys and Kubernetes secrets from the environments where it was installed. In the organizations affected, the file came in through the standard dependency installation route, into pipelines that automatically pulled the latest published version. That is precisely the channel an EDR does not see.

Securing an information system should not mean piling up solutions and technologies. The question that ought to guide organizations is a different one: is threat detection in place everywhere the risks actually sit?

Perimeter controls such as firewalls and proxies only inspect what crosses their checkpoint. A file already stored in a storage space, or uploaded to an internal application with no web application firewall in front of it, never crosses that line and stays invisible to them. Analyzing as close as possible to the data, where it is received and where it is kept, is therefore the first condition.

That analysis then has to fit the diversity of these environments. A file server, a NAS, a development pipeline and a privileged access bastion do not share the same integration methods, nor the same appropriate response once a file turns out to be malicious. One calls for immediate quarantine, another for file sanitization or a clean-file report before the document goes back into circulation. A single generic building block cannot cover all of these cases, and remediation works better when it stays automatic rather than depending on manual intervention every time.

GLIMPS designs its file analysis and malware detection solutions on this basis, adapting them to the environment to be protected: from storage to business applications, and from network flows to development pipelines.