https://xevolve.io/blog/ Regulated file transfer operations — migration, audit, and security notes. en Thu, 16 Jul 2026 00:00:00 GMT https://xevolve.io/blog/dora-threat-led-penetration-testing-tlpt/ https://xevolve.io/blog/dora-threat-led-penetration-testing-tlpt/ Thu, 16 Jul 2026 00:00:00 GMT DORA — Regulation (EU) 2022/2554, the Digital Operational Resilience Act — has applied since 17 January 2025. Financial entities across the EU now operate under a new framework for testing ICT resilience. One of its most demanding requirements is threat-led penetration testing, or TLPT. Unlike annual vulnerability scans or staged penetration tests run on isolated test systems, TLPT is intelligence-driven, runs against live production systems, and requires independent testers. Understanding who must run it, what it covers, and how file transfer systems fit into scope is now a compliance necessity, not a future concern. https://xevolve.io/blog/ftp-vs-mft-when-scripts-stop-scaling/ https://xevolve.io/blog/ftp-vs-mft-when-scripts-stop-scaling/ Thu, 16 Jul 2026 00:00:00 GMT Plain FTP is dead — no encryption, no authentication beyond a password, no audit trail. But SFTP, backed by shell scripts and cron jobs, still runs critical workflows at many organizations. It is cheap, familiar, and works fine until it does not. This post walks through the honest trade-offs: when scripted SFTP is fine, when it breaks down, and what MFT adds to solve those breaks. https://xevolve.io/blog/gdpr-file-transfer-requirements/ https://xevolve.io/blog/gdpr-file-transfer-requirements/ Thu, 16 Jul 2026 00:00:00 GMT GDPR is often invoked as a monolithic compliance requirement, but which Articles actually govern file transfer? This post maps the real requirements: what encryption means under GDPR, what happens when a file is deleted (and how to prove it), what your processor contract must say, and what a breach notification actually requires. No legal advice here — just a reading of the regulation that applies to the file transfer layer. https://xevolve.io/blog/what-is-managed-file-transfer/ https://xevolve.io/blog/what-is-managed-file-transfer/ Thu, 16 Jul 2026 00:00:00 GMT Managed file transfer, or MFT, is a confusing term because every vendor uses it differently. Some call their SFTP server with a web UI an MFT platform. Others reserve MFT for enterprise platforms that do scheduling, retries, audit logging, and protocol adaptation. The honest definition: MFT is the infrastructure that replaces shell scripts and cron jobs for moving files between systems and partners. What does that infrastructure actually do? https://xevolve.io/blog/as2-vs-sftp-when-buyers-ask/ https://xevolve.io/blog/as2-vs-sftp-when-buyers-ask/ Fri, 12 Jun 2026 00:00:00 GMT Procurement RFPs increasingly ask "do you support AS2 and SFTP?" as if they are interchangeable. They are not — they solve different integration problems. Giving a crisp comparison wins technical evals; hand-waving sends buyers to a competitor who maps protocols to use cases. https://xevolve.io/blog/cron-schedules-vs-folder-watchers/ https://xevolve.io/blog/cron-schedules-vs-folder-watchers/ Fri, 12 Jun 2026 00:00:00 GMT Every MFT migration replays the same architecture debate: poll on a schedule or react when a file lands. Both patterns work; choosing wrong creates missed SLAs, duplicate transfers, or audit gaps when nobody can explain why a job ran twice at 2:07 a.m. https://xevolve.io/blog/data-room-vs-sftp-share/ https://xevolve.io/blog/data-room-vs-sftp-share/ Fri, 12 Jun 2026 00:00:00 GMT Teams pick SFTP shares for speed and data rooms for branding. Compliance failures come from using the wrong pattern for the counterparty. https://xevolve.io/blog/entra-sso-for-sftp-operations/ https://xevolve.io/blog/entra-sso-for-sftp-operations/ Fri, 12 Jun 2026 00:00:00 GMT Legacy SFTP appliances authenticate with local accounts, shared passwords, and SSH keys stored in spreadsheets. Security teams moved to Entra ID years ago; file-transfer ops often did not follow. When a vendor questionnaire asks how operators access production MFT, "we SSH to a jump box" is no longer a passing answer. https://xevolve.io/blog/iso-27001-evidence-for-file-transfer/ https://xevolve.io/blog/iso-27001-evidence-for-file-transfer/ Fri, 12 Jun 2026 00:00:00 GMT ISO 27001:2022 Annex A puts information transfer and logging squarely in scope. Teams pass network and endpoint audits, then fail the surveillance audit because their SFTP share has no exportable evidence. Auditors do not care that files moved successfully — they care that you can prove who moved them and that the control operated for the full period. https://xevolve.io/blog/mft-security-controls-2026/ https://xevolve.io/blog/mft-security-controls-2026/ Fri, 12 Jun 2026 00:00:00 GMT Vendor security questionnaires in 2026 assume cloud-native MFT, not appliance SFTP. The baseline moved. https://xevolve.io/blog/sftp-to-cloud-migration-checklist/ https://xevolve.io/blog/sftp-to-cloud-migration-checklist/ Fri, 12 Jun 2026 00:00:00 GMT Legacy SFTP appliances survive because auditors keep asking the same four questions. Migration projects fail when teams move files but cannot answer them on day one of production. https://xevolve.io/blog/vendor-risk-questionnaire-mft/ https://xevolve.io/blog/vendor-risk-questionnaire-mft/ Fri, 12 Jun 2026 00:00:00 GMT Enterprise buyers send 200-question security assessments before they let you touch production data. MFT vendors get stuck on the same dozen items every quarter. Knowing which questions are real blockers — and which are checkbox theater — saves weeks on procurement. https://xevolve.io/blog/retention-policy-on-paper-not-on-disk/ https://xevolve.io/blog/retention-policy-on-paper-not-on-disk/ Fri, 13 Feb 2026 00:00:00 GMT You are the GRC lead. You wrote the data retention policy, got it signed off, and filed it in the ISMS. It says regulated payment and PII files live for 90 days, then get deleted. Buried in that one sentence is an assumption: that "the policy says 90 days" and "the system enforces 90 days" describe the same fact. They do not. https://xevolve.io/blog/acquired-company-mft-due-diligence-gap/ https://xevolve.io/blog/acquired-company-mft-due-diligence-gap/ Thu, 22 Jan 2026 00:00:00 GMT Data diligence on a deal tends to mirror the data room: organized by named system. The GRC lead asks for the target's MFT platform, its SFTP server inventory, its DLP coverage, and a list of partner connections. The answers come back tidy, the compliance workstream goes green, and everyone moves on. The flaw is in the framing. You audited the systems someone wrote down. Regulated data moves through the systems nobody wrote down, and at close you own both. https://xevolve.io/blog/entra-sso-but-service-accounts-bypass-it/ https://xevolve.io/blog/entra-sso-but-service-accounts-bypass-it/ Thu, 01 Jan 2026 00:00:00 GMT "SFTP is behind Entra SSO now" is a sentence that has ended more than one board discussion early. The director shows a coverage figure in the high nineties and moves on. It is accurate, and it counts the wrong people. It counts the handful of humans who sign in to eyeball a folder. It ignores the cron jobs, the partner ETL processes, and the integration middleware that actually move the files, which still authenticate with a static password or shared key that no MFA prompt ever sees. https://xevolve.io/blog/iso27001-evidence-export-takes-three-weeks/ https://xevolve.io/blog/iso27001-evidence-export-takes-three-weeks/ Wed, 10 Dec 2025 00:00:00 GMT Your controls are in good shape. Access gets reviewed every quarter, SFTP keys rotate on schedule, every transfer writes a log line. So when the surveillance audit lands and the auditor asks for evidence across the file-transfer estate, you treat it as paperwork. Then you go to pull it, and you find out that a control being true and a control being exportable are two different things. Most teams learn the difference with the clock already running. https://xevolve.io/blog/scheduled-job-failed-silently-missed-sla/ https://xevolve.io/blog/scheduled-job-failed-silently-missed-sla/ Wed, 19 Nov 2025 00:00:00 GMT Somewhere in your estate there is a crontab line that pushes a settlement file to a partner at 02:00. It has fired for two years. Over that time one belief quietly calcified into operational fact: the job runs, therefore the files arrive. Those are two separate claims, and the gap between them is exactly where the SLA breach hides. https://xevolve.io/blog/tenant-isolation-failure-cross-customer-leak/ https://xevolve.io/blog/tenant-isolation-failure-cross-customer-leak/ Tue, 28 Oct 2025 00:00:00 GMT A CISO signs off on a shared transfer host because the vendor's diagram shows each customer landing in its own folder: /tenants/acme/inbound, /tenants/globex/inbound, distinct owners, distinct group ACLs. It reads as multi-tenant, so folder-level separation gets accepted as the isolation boundary and the review moves on. https://xevolve.io/blog/trading-partner-mandated-protocol-cant-support/ https://xevolve.io/blog/trading-partner-mandated-protocol-cant-support/ Tue, 07 Oct 2025 00:00:00 GMT An ops manager standardizes on one protocol to keep the estate clean. Usually it's SFTP: every partner understands a folder, the team already runs the keys, and one transport is easier to watch than three. That clean estate holds right up until a large customer sends an onboarding packet that reads AS2, encrypted payloads, signed MDN required. https://xevolve.io/blog/data-residency-broke-on-transfer-hop/ https://xevolve.io/blog/data-residency-broke-on-transfer-hop/ Mon, 15 Sep 2025 00:00:00 GMT The compliance lead signs off on data residency the usual way. The database lives in Frankfurt, the compute runs in an EU region, the backups stay in-zone. The attestation goes to the regulated buyer, the DPA gets countersigned, everyone moves on. The storage map was correct. The transfer map was never drawn. https://xevolve.io/blog/per-transfer-audit-trail-missing/ https://xevolve.io/blog/per-transfer-audit-trail-missing/ Wed, 27 Aug 2025 00:00:00 GMT The SFTP server records every connection: source IP, username, timestamp, session duration. The compliance lead points at the folder and calls it the audit trail. It is a doorbell log. It proves someone rang, and nothing about what they carried, who took it, or whether it arrived intact. https://xevolve.io/blog/nis2-supply-chain-file-transfer-liability/ https://xevolve.io/blog/nis2-supply-chain-file-transfer-liability/ Tue, 05 Aug 2025 00:00:00 GMT Watch a CISO scope NIS2 supply-chain obligations and you can predict the list: cloud hosting, the EDR vendor, the identity provider, maybe the MSSP. Meanwhile the platform pushing payroll files, claims data, and EDI feeds to two hundred trading partners every night sits one floor down in an ops folder, owned by an integration team nobody invited to a risk meeting. It never makes the list. https://xevolve.io/blog/renewal-shock-per-connection-mft-pricing/ https://xevolve.io/blog/renewal-shock-per-connection-mft-pricing/ Thu, 17 Jul 2025 00:00:00 GMT Whoever signs the MFT contract reads the unit price and skips the unit. The line item says a few hundred dollars per trading-partner connection a year, the first invoice covers twenty partners, and against the budget the total looks fine. The question that sets the three-year cost never gets asked: what does that price do when the partner count doubles, then doubles again? https://xevolve.io/blog/fund-mft-after-the-breach-not-before/ https://xevolve.io/blog/fund-mft-after-the-breach-not-before/ Wed, 25 Jun 2025 00:00:00 GMT The budget owner sees the line item, recognizes the number, and files governed file transfer under discretionary infrastructure. It works today. The scripts run, partners get their files, nobody is complaining. So the request slides to next cycle, then the one after. The logic holds for everything but the risk with no row in the spreadsheet: the cost of not having governed transfer, which sits at zero until the day it becomes a headline. https://xevolve.io/blog/protocol-sprawl-across-silos/ https://xevolve.io/blog/protocol-sprawl-across-silos/ Wed, 04 Jun 2025 00:00:00 GMT An infrastructure director rarely chooses tool sprawl. It arrives one approved exception at a time. Finance already had an FTPS client bundled with the ERP, so that stayed. The integration team needed AS2 for a retail partner, bought a point product, and moved on. Ops wrote a cron job around sftp because it was Tuesday and the file had to land by Wednesday. A SaaS connector showed up to push exports to a marketing vendor. None of those calls was wrong on its own. https://xevolve.io/blog/deletion-you-cannot-prove-gdpr/ https://xevolve.io/blog/deletion-you-cannot-prove-gdpr/ Wed, 14 May 2025 00:00:00 GMT An erasure request comes in. The compliance lead opens the customer record, runs a DELETE, closes the ticket. The row is gone, and the line to the regulator writes itself: "we erased it." Except that record arrived as a CSV over SFTP. An ETL job picked it up, dropped it in a staging directory, archived a copy for replay, and forwarded it to a partner whose inbound queue you do not control. Five copies, one delete. https://xevolve.io/blog/we-use-sftp-answer-lost-the-deal/ https://xevolve.io/blog/we-use-sftp-answer-lost-the-deal/ Tue, 22 Apr 2025 00:00:00 GMT Your vendor-risk lead opens the file-transfer section of a buyer's security questionnaire and types one sentence: we encrypt files in transit using SFTP. It reads as finished. The protocol is named, encryption is named, the field is filled. Two weeks later the thread goes cold, and nobody on your side traces the silence back to that line. https://xevolve.io/blog/orphaned-ssh-keys-after-offboarding/ https://xevolve.io/blog/orphaned-ssh-keys-after-offboarding/ Thu, 03 Apr 2025 00:00:00 GMT A contractor wraps up a six-week SFTP integration. The manager files the offboarding ticket, IT disables the identity in Entra, and the CISO signs the attestation that access was removed. What nobody checks is the contractor's public key, still sitting in ~/.ssh/authorized_keys on the SFTP host. That host never asked Entra for permission to let anyone in, and it isn't going to start now. https://xevolve.io/blog/expired-as2-certificate-stopped-supply-chain/ https://xevolve.io/blog/expired-as2-certificate-stopped-supply-chain/ Mon, 17 Mar 2025 00:00:00 GMT Onboard a trading partner, watch the first signed payload round-trip cleanly, see a green 200 and a valid MDN, and you mark AS2 as done. That is the trap. An AS2 certificate carries an expiry date, and when it passes, nobody gets a warning worth reading until live traffic stops. https://xevolve.io/blog/dora-made-file-transfer-board-level-risk/ https://xevolve.io/blog/dora-made-file-transfer-board-level-risk/ Sun, 23 Feb 2025 00:00:00 GMT Walk through any second-line DORA scoping exercise and you can predict the list before it's written: core banking, the payments rails, the cloud provider with the eight-figure contract. Those get classified, dropped into the Register of Information, and the third-party inventory is declared done. The managed file transfer platform never makes the list. Nobody on the second line treats it as a system. It is the thing that moves the files, and it has always been there. https://xevolve.io/blog/shadow-sftp-server-auditor-finds-it/ https://xevolve.io/blog/shadow-sftp-server-auditor-finds-it/ Tue, 04 Feb 2025 00:00:00 GMT You sign off on the asset register because the CMDB says it is complete. That signature rests on one assumption: every endpoint moving customer data is in the inventory, owned, classified, and scanned. The assumption is wrong, and it usually fails first at a Linux box running sshd that someone stood up in 2023 to unblock a partner integration and never told you about.