A zip file with a password on it looks like any other attachment. It arrives, it sits in a mailbox, and it waits to be opened.
For a scanner, that file is closer to a locked box than to a document. This matters because many office security checks work by looking inside files, and encryption, the math that scrambles data so only someone with the key can read it, closes that option.
A simple analogy
Imagine airport screening. A clear bag lets an officer see the contents without opening it. A locked metal case does not. The officer can weigh it, scan its outline, and ask who packed it, but the contents stay unknown.
An encrypted archive is the locked case. The tool can still see the outside: the file name, the size, the type, the sender, and sometimes the names of the files inside. What it cannot see is the text, the images, or anything hidden in them.
Why inspection struggles
An archive is a container, meaning one file that holds other files inside it. Common formats include zip, 7z, and rar. Archives also compress, which means they squeeze data into a smaller space by reusing repeated patterns.
Password protection adds encryption as another layer. The contents become unreadable without the secret, and the password is usually turned into a key by a key derivation function, which is a deliberately slow calculation meant to make guessing expensive. That slowness helps defense, and it is one reason automated checking is awkward.
Inspection tools normally do a few things with a file. They identify the type, open it, read the text, and compare that text against patterns or rules. With an encrypted archive, the step of opening it stops at the door.
What remains is metadata, which is data about the data: size, name, sender, recipient, timing, and the list of entries if the format stores those names in the clear. From that, a tool can make soft judgments. A 400 MB archive sent to a personal address just after a resignation looks different from a 200 KB one sent to a colleague.
Some systems try a few known passwords, or check whether the archive opens with no password at all. Others fall back on behavior: if a file cannot be inspected, apply the policy for unknown content. That may mean blocking, quarantining, or allowing with a warning. In my view, "unknown" should be a real outcome that someone owns, not a quiet pass.
There is an important wrinkle. Encryption is the same technology used for good reasons. Sending a contract to a client inside an encrypted archive, with the password shared by phone, is a reasonable way to protect data on the move. The signal is therefore weak on its own: a locked archive suggests a closer look, not bad intent.
Cracking attempts, which try many passwords quickly, are the heavy option. Modern archive formats make each guess slow on purpose, so this tends to be practical only for short or weak secrets. Against a long random password, the math is not on the attacker's side within any useful time.
Real-world example
An employee in finance emails a compressed folder of payroll files to an external accountant every month. The folder is password protected and the password goes by text message. The company's mail scanner records the attachment and reports it as uninspectable.
For months nobody notices, because uninspectable is not the same as blocked. Some vendors build unified office security systems, such as Ping64, to bring data leakage prevention and endpoint management into a single platform. Even then, the decision about what to do with a locked file has to be written down somewhere.
Limits and common misconceptions
A password on an archive does not keep the contents invisible forever. If someone opens it on a company laptop, the files may land in a temporary folder, in a sync client, or in a local cache. Controls that watch the device can see what happens after the opening.
Encryption also does not prove that the contents are harmless. A locked box can hold quite an ordinary report or something the sender should never have taken. The lock says nothing about the contents, only about who can read them.
Another mistake is assuming the file list is hidden when it may not be. Some zip setups keep entry names readable while newer formats can hide them too. Whether names are visible depends on the format and the options chosen, so it needs checking rather than assuming.
Blocking every encrypted archive tends to break normal work, and people then find other paths, such as personal mail or chat, which are harder to see. A policy that allows locked archives with a stated reason and a log may be more practical than a flat ban.
One more point: the archive is only one stage. After extraction, the files inside are ordinary files again, and whatever inspection happens on the device applies to them normally.
Closing
A password-protected archive is not a threat by itself. It is a file that refuses to be read, which places a decision in someone's hands: allow it, block it, or ask about it.
Writing that decision down before the first locked attachment arrives is the part many teams skip.
Top comments (0)