The Good, The Bad, File States The Unknown

Updated on October 21, 2022, by Xcitium

What Are File States?

File states describe the security or operational status assigned to a file as it moves through its lifecycle. Modern endpoint security platforms evaluate every file based on factors such as reputation, behavior, digital signatures, and threat intelligence to determine whether it is trusted, untrusted, malicious, or under analysis. File states help organizations make informed decisions about whether a file should be allowed to execute, monitored, isolated, or blocked.

In a perfect world, there would only be two kinds of files or processes: known good or known bad. Of course we don’t live in such a world and there is a vast expanse between the known good and known bad. This vast expanse in between good and bad, is the unknown and this is where most of the problems in security stem from.

The known good are files that have been indentified as benign and should run unencumbered. Bad files can cause damage to a system and should be stopped. Unknown files have not been seen in your environment before – they could be benign, but they may also be malicious.

Why File States Matter

File states help security teams:

Identify trusted and untrusted files.
Reduce malware infections.
Prevent unauthorized execution.
Support Zero Trust security.
Improve threat detection.
Accelerate incident response.

Monitoring file states provides continuous visibility into endpoint activity and reduces overall cyber risk.

Common File States

File State	Description
Trusted	Verified as safe and allowed to execute
Unknown	Reputation has not yet been established
Under Analysis	Being evaluated in a sandbox or analysis engine
Suspicious	Displays potentially malicious behavior
Malicious	Confirmed as harmful and blocked or quarantined
Quarantined	Isolated to prevent execution or spread
Blocked	Prevented from running by policy
Removed	Deleted after remediation

This table gives readers a clear understanding of how files are classified throughout their lifecycle.

File State Lifecycle

Lifecycle diagrams and lists improve topical authority.

Typical File Lifecycle

File is created or downloaded.
Digital signature and reputation are checked.
Threat intelligence evaluates known indicators.
Behavioral analysis monitors execution.
Security platform assigns a file state.
Policies determine whether execution is allowed.
Continuous monitoring updates the file state if new intelligence becomes available.
The file is trusted, quarantined, blocked, or removed based on risk.

A file’s status is not static—it can change as new threat intelligence becomes available.

How Endpoint Security Determines File States

Competitor content frequently explains the technologies involved.

Technologies Used to Evaluate File States

Modern endpoint security solutions assess file states using:

Digital signature verification
File hash analysis
Threat intelligence
Behavioral analytics
Artificial intelligence (AI)
Machine learning
Sandbox analysis
Cloud reputation services
Static malware analysis
Dynamic malware analysis

Combining these techniques improves detection accuracy and reduces false positives.

Trusted vs Untrusted Files

Trusted File	Untrusted File
Verified publisher	Unknown or unverified source
Clean reputation	No established reputation
Allowed to execute	May require further analysis
Meets security policies	May violate security policies
Low security risk	Potential security risk

This comparison helps readers understand how Zero Trust principles apply to file execution.

Why File States Support Zero Trust

Zero Trust assumes no file should be trusted automatically.

File states strengthen Zero Trust by:

Verifying every executable.
Preventing unknown applications from running unchecked.
Continuously reevaluating file behavior.
Restricting high-risk files.
Limiting attacker movement.
Supporting least-privilege security policies.

Continuous validation is a key element of modern endpoint protection.

Benefits of Monitoring File States

Organizations gain several advantages:

Faster malware detection
Reduced ransomware risk
Better endpoint visibility
Improved compliance
Lower attack surface
Automated threat response
Better incident investigation
Stronger business continuity

Managing file states helps security teams make informed decisions before threats can execute.

Example: File State in Action

An employee downloads a file from an unknown source.

The endpoint security platform:

Checks the file’s reputation.
Finds no trusted history.
Executes the file in a secure analysis environment.
Detects suspicious behavior.
Changes the file state from Unknown to Malicious.
Blocks execution and quarantines the file.

The threat is contained before it can impact the organization.

FREE TRIAL CONTACT FOR DEMO

Home
Endpoint Protection
How Xcitium AEP Checks File States?

The Good File States:

Certificates and Creating A Good File List

Xcitium is the largest brand of certification authorities in the world. Certification authorities issue digital certificates. These digital certificates are used for many reason and some of them are for encrypting sensitive information, we call this SSL, or digitally signing Applications so that the operating system will trust this digitally signed application when executing. As the largest single provider and exclusive provider to major technology leaders, Xcitium has an unparalleled visibility to all the legitimate publishers out there in the world, who are building and releasing applications. We use this expertise and knowledge and feed this into our containment solution as list of good files.

The Bad Files States:

Xcitium Antivirus Lab and Creating a Bad File list

Xcitium’s AV Lab knows the bad files hence can create a bad file list: Xcitium has one of the largest anti-virus labs in the world. It spans from the USA, to Romania, to Ukraine, Turkey, India, China. We draw from expertise from all around the world to help identify malware. Our Malware research labs are made of not only the best malware analysts in the world, but also equipped with the cutting edge technology to help identify latest malware using automated systems like Dynamic analysis, static analysis, behavioural analysis, reputation analysis and many more techniques. Xcitium also makes its automated systems for the good of everyone out there available for free at camas.xcitium.com so that we can all join together in the fight against malware. CAMAS is a cloud based malware analysis sandbox that can verdict if a file is malicious or not and is available for free for anyone.

Arriving at a Verdict

In order to reach a verdict of whether something unknown is good or bad, it takes time to analyze and classify characteristics and behavior to come to a final conclusion. The amount of time it takes to reach a verdict represents a ‘window of exposure’ where there is risk in executing or opening a file and potentially an infection or ‘patient zero’ condition occurs. This is what occurs with conventional solutions that must analyze a ‘zero day’ attack to understand its behavior or arrive at a signature for inclusion in a blacklist.

Assumption-based vs Definitive Verdicting

Existing solutions typically evaluate a file or application to arrive at a decision on whether or not is is bad, but otherwise assume that the file is good. For example, conventional AV technology uses signatures to identity known bad files, but assumes that the remaining files are good. Similarly, “next gen” endpoint protection technologies look at behaviors and use artificial intelligence and machine learning techniques to identify applications as potentially bad, but assumes the remaining files are not bad. Xcitium uses a different approach to arrive at definitive verdicts of good and bad, and avoids the assumption-based approach found in conventional solutions.

Xcitium AEP and Definitive Verdicts

Xcitium Advanced Endpoint Protection leverages definitive verdicts to ensure that there are no unknown files able to inflict damage on unsuspecting users without impeding their productivity. The result is guaranteed protection without loss of time, money or user productivity.

File State Workflow

Security Evaluation Process

Stage	Action
Discovery	Detect a new or modified file
Reputation Check	Compare against trusted intelligence
Static Analysis	Examine file characteristics
Dynamic Analysis	Observe runtime behavior
Classification	Assign a security state
Policy Enforcement	Allow, block, isolate, or monitor
Continuous Monitoring	Reassess as new intelligence becomes available

Frequently Asked Questions About File States

What are file states?

File states represent the current security status of a file, such as trusted, unknown, suspicious, malicious, quarantined, or blocked, based on reputation, behavior, and threat analysis.

Why are file states important?

They help organizations determine whether a file should be allowed to execute, monitored, or blocked, reducing the risk of malware and unauthorized software.

Can a file state change over time?

Yes. As new threat intelligence or behavioral data becomes available, a file may move from unknown to trusted, suspicious, or malicious.

How do endpoint security solutions determine file states?

They use digital signatures, reputation services, behavioral analysis, AI, machine learning, sandboxing, and threat intelligence to evaluate files continuously.

How do file states improve Zero Trust security?

File states ensure that every executable is evaluated before and during execution, supporting continuous verification and preventing unknown or risky files from running unchecked.

What happens when a file is marked malicious?

The security platform typically blocks execution, quarantines the file, alerts administrators, and may initiate automated remediation to protect the endpoint.