1. A method comprising: capturing, by a network security appliance, network traffic; extracting, by the network security appliance, a media file from the network traffic; determining, by the network security appliance, presence of a hidden data item embedded in the media file in a machine-readable form; when said determining is affirmative, then performing, by the network security appliance, one or more actions on the media file based on a predefined security policy.