For years, cybersecurity strategies have been built around a simple assumption: stop malicious files, stop the attack.