A financial controller receives an email from what appears to be a legitimate, long-standing supplier. The email contains an invoice, a common attachment. Unbeknownst to them, the supplier's system was breached, and this specific invoice PDF has been subtly altered. It looks normal, opens normally, and even passes initial antivirus scans because the malicious code isn't a known signature. It's a zero-day exploit embedded deep within the file's structure.
The controller opens it. Without a strong CDR layer, this seemingly innocuous PDF could deploy malware, giving attackers a backdoor into the financial network, potentially leading to widespread ransomware or data exfiltration days or weeks later.