Attachment and link security covers scanning files and URLs in inbound mail (sandboxing, detonation, URL rewriting and time-of-click checks) and safe handling policies for outbound content.
What good looks like#
- Done: Block executable and macro-enabled attachment types at the gateway.
- Done: Enable URL rewriting with time-of-click reputation checks.
- Done: Sandbox unknown attachments before delivery.
- Done: For outbound, prefer links to authenticated portals over attachments for sensitive files.
What bad looks like#
- Seen in audits: Allow-listing partner domains and bypassing scanning entirely.
- Seen in audits: Password-protected archives that evade scanning.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
Are PDF attachments safe?
Mostly, but PDFs can carry scripts and phishing links. Sandboxing and link rewriting still apply.