TL;DR: Compressed files are often where cloud data security breaks down, because ZIPs, TAR.GZs, password-protected archives, and nested packages can hide PII, credentials, backups, and other sensitive data that legacy scanners miss, according to Sentra. The core issue is not file format complexity alone but the governance gap created when organisations assume archive contents are already covered by existing discovery and classification controls.
At a glance
What this is: Sentra argues that archive scanning is now a prerequisite for cloud data security because compressed files commonly conceal sensitive data that ordinary scanners never inspect.
Why it matters: For cloud security, data security and IAM practitioners, hidden archives create a blind spot where credentials, backups and regulated data can escape discovery, classification and governance.
Context
Compressed files are not just storage wrappers. In cloud environments they often contain the most sensitive material in the stack, including backups, database dumps, source packages and exported reports.
The governance gap appears when discovery tools only inspect the outer file and assume the inner content is already covered. That assumption breaks data security posture management because archive contents can hold regulated data, embedded credentials and other assets that still need control.
At scale, archive scanning becomes part of cloud data governance rather than a niche file-format feature, because compressed content is a routine place for sensitive data to hide.
Key questions
Q: What breaks when cloud scanners stop at the archive boundary?
A: Discovery becomes incomplete because the outer container is visible while the inner payload remains unchecked. That means regulated data, embedded secrets and backups can sit in cloud storage without classification or remediation, which turns archive handling into a governance gap rather than a format issue.
Q: Why do encrypted archives increase cloud data security risk?
A: They create a visibility exception. Even if a scanner cannot decrypt the contents, it should still record the archive, its location, its size and its ownership so the object can be governed as high risk instead of silently ignored.
Q: How should teams prioritise scanning inside large compressed files?
A: Start with file types most likely to carry sensitive data, such as CSVs, PDFs, backups and exported reports. That sequencing surfaces the highest-value findings first and prevents low-risk content from delaying exposure of regulated data.
Q: Why does archive scanning matter for secrets governance as well as data security?
A: Because compressed files often contain .env files, API keys, tokens and certificates alongside ordinary documents. If those artifacts are not inspected, secret exposure can persist inside storage objects that appear harmless from the outside.
Technical breakdown
Why recursive archive parsing matters in cloud data security
Archive scanning has to recurse through nested layers because cloud workloads routinely stack formats such as ZIP inside TAR.GZ or package files inside other archives. A scanner that stops at the first container only proves that the outer shell exists, not what data it holds. The real control requirement is to feed each extracted object back into the same classification engine used for ordinary files so that sensitive records, embedded secrets and regulated content are discovered consistently across layers.
Practical implication: require recursive inspection for all archive and package formats in your discovery pipeline.
Why encrypted archives still need governance
Password-protected archives are not automatically harmless. They are often the files most likely to contain high-value data, yet many tools either skip them or record only that they exist. Governance does not require breaking encryption, but it does require visibility into where encrypted archives live, how large they are and whether they are being treated as exceptions. That visibility turns opaque objects into items that can be risk-ranked, investigated or routed to separate handling controls.
Practical implication: flag encrypted archives as governed assets even when their contents cannot be decrypted during routine scanning.
How archive scanning changes data prioritisation
Not every file inside an archive has the same security value. A compressed bundle full of binaries is not equivalent to one full of CSVs, PDFs or backup exports containing personal or financial data. Prioritising high-risk file types inside archives lets a platform surface the most relevant findings before resources are spent on low-value material. In cloud data security, that sequencing matters because large archives can otherwise bury critical exposure behind volume.
Practical implication: rank archive contents by sensitive file type so regulated data is found before low-risk noise.
Threat narrative
Attacker objective: The attacker or insider objective is to hide sensitive data inside compressed containers long enough to avoid discovery and increase the value of exfiltration or misuse.
- Entry occurs when sensitive data is packed into archives such as ZIPs, TAR.GZs, package files or backups and then stored in cloud repositories that scanners do not inspect deeply.
- Credential or data exposure follows when embedded secrets, regulated records or backups remain hidden inside nested or encrypted containers that existing discovery tools skip.
- Impact is the loss of end-to-end visibility, which allows sensitive cloud data to persist in storage without classification, remediation or governance.
Breaches seen in the wild
- Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Archive scanning is now a control gap issue, not a file-format feature issue. The article shows that compressed content can hold the same regulated data and embedded secrets as any other storage class, but legacy tools still treat the outer container as the unit of inspection. That creates false confidence in discovery coverage and leaves governance blind to the inner payload. Practitioners should treat archive inspection as part of baseline cloud data security, not an optional enhancement.
Recursive discovery is the named concept that matters here. Archive visibility only works when each inner file is re-entered into the same classification pipeline as the parent container. Without that recursion, nested archives, package files and backup artifacts become a structured hiding place for sensitive information. The practical conclusion is that data security posture is incomplete whenever scanners stop at the first layer.
Encrypted archives create a visibility exception that must be governed explicitly. The article is right to separate decryption from visibility: organisations do not need to brute-force passwords to recognise that an encrypted archive is high risk. What fails in practice is the assumption that inaccessible content can be ignored. Security teams should govern encrypted archives as pending risk items with ownership, location and handling rules.
Cloud data security and NHI governance intersect inside archives. The examples in the article include .env files, API keys, tokens and backup artefacts, which means archive scanning is also an identity-security problem when secrets are packed into storage objects. That makes hidden archives relevant to secret discovery, credential lifecycle oversight and incident triage, especially where workload or application credentials are bundled into artifacts. Practitioners should align archive scanning with secrets governance rather than treating it as a pure data-classification task.
Cloud data security posture management needs a blind-spot test. A platform that cannot inspect compressed content is not delivering end-to-end visibility, even if it classifies ordinary files well. The operational implication is simple: test whether your discovery and DLP controls can see inside nested, encrypted and package-style archives before you rely on them for assurance.
From our research library:
- 82% of breaches involved data stored in the cloud, according to IBM (2024).
What this signals
Archive scanning is a visibility control, not a convenience feature. Once cloud storage becomes the default place for backups, package files and shared exports, any scanner that stops at the first layer leaves governance blind to the material most likely to contain sensitive data.
Recursive archive visibility: the control objective is to make inner files subject to the same discovery and classification workflow as the outer container. That is the difference between knowing an archive exists and knowing whether it contains regulated records, credentials or backup data.
For practitioners, the operational test is simple: if your cloud data security stack cannot inspect nested archives and package files, it cannot claim end-to-end coverage of the storage estate.
For practitioners
- Implement recursive archive inspection Require discovery tools to unpack nested ZIP, TAR.GZ, 7Z, JAR, RAR and package layers and send inner files back through the same classification pipeline.
- Govern encrypted archives as high risk Track encrypted archives by location, size and owner so they can be escalated, investigated or placed under separate handling rules even when contents remain unreadable.
- Prioritise sensitive file types inside archives Classify CSV, PDF, database backup and report formats ahead of low-value binaries so regulated data surfaces before large archives consume scanning time.
- Treat embedded secrets as a cloud data issue Search archives for .env files, API keys, tokens and certificates because secrets hidden in build artifacts and backups create both data and identity exposure.
- Test for end-to-end visibility gaps Validate that cloud data security controls do not stop at the container boundary and that archive contents are discoverable in the same workflow as standard documents.
Key takeaways
- Compressed files are a common hiding place for regulated data and embedded secrets, and basic scanners miss the risk when they stop at the container boundary.
- Recursive inspection is the decisive control because it makes nested archives, package files and backups visible to the same discovery workflow as ordinary files.
- Archive scanning should be treated as part of cloud data governance and secrets governance, not as a narrow file-format enhancement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Archives in this article hide API keys, tokens and certificates inside cloud storage. |
| NHI-07 — Long-Lived Secrets | Old backups and dormant archives extend the lifetime of secrets beyond their intended use. | |
| Recommendation — Scan compressed files for leaked secrets and revoke any credentials found in archived content. Search backup archives for aged credentials and remove them from long-term retention paths. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | The article is about protecting stored cloud data that remains invisible inside archives. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Archived files in shared storage still need governed access even when contents are compressed. | |
| Recommendation — Extend data-at-rest controls to inspect compressed containers, not just uncompressed files. Apply access and authorization checks to archived objects as part of cloud storage governance. | ||
| CIS Controls v8 | CIS-3 — Data Protection | Archive scanning is a data protection problem because sensitive records are hidden in compressed files. |
| Recommendation — Include compressed and nested files in your data protection and discovery coverage. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article's examples include hidden credentials and bulk data that can be exfiltrated from archives. |
| Recommendation — Map archive-borne secret exposure to credential access and exfiltration detection workflows. | ||
Key terms
- Archive Scanning: Archive scanning is the process of inspecting compressed or packaged files for sensitive data, secrets or policy violations. Effective scanning does not stop at the outer container. It recursively evaluates inner files so cloud security teams can see what is actually stored inside ZIPs, TAR.GZs, RARs and similar formats.
- Partial Parsing: Partial parsing converts code into a usable tree even when the file is incomplete or syntactically invalid. This lets analysis tools keep working on code that would otherwise fail a strict parser. For security scanning, partial parsing improves resilience and broadens coverage during active development.
- Encrypted Archive: An encrypted archive is a compressed file whose contents are protected by password or cryptographic controls, making the payload unreadable without the right key or secret. Security teams still need to govern these files by metadata, location, and risk, even when the contents cannot be inspected directly.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity controls with broader security programmes and operational governance.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org