What’s the difference between attachment scanning and link scanning?

Picture two emails landing in your inbox at the same time. One has a Word document attached. The other has a button that says "View Invoice" linking to some sketchy URL. Both could wreck your day. But catching each one requires a completely different approach.

That's the core of why attachment scanning and link scanning exist as separate disciplines, even when they're bundled together in the same security product.

Attachment scanning looks at what's inside a file before it ever reaches you. It checks code patterns against known malware signatures, and sometimes runs the file in an isolated sandbox environment to watch what it actually does when opened. The goal is catching malicious payloads, things like trojans, ransomware, or macro-enabled scripts, before they ever touch your system.

Link scanning works differently. It checks URLs against reputation databases, looks at where the link actually resolves to, and may even fetch the destination page to analyze its content. Some enterprise systems rewrite every link in your email so the click routes through a scanning proxy first. That way, if a URL gets flagged between delivery and the moment you click it, you're still protected.

That timing difference matters more than it sounds. Attachment scanning happens at delivery. Link scanning can keep working after delivery, which is useful because attackers sometimes host clean pages initially and swap in malicious content later (a technique called time-of-click manipulation).

The threats they catch are also different. Attachments are the go-to vector for malware drops. Links are the go-to vector for phishing, where the destination is a fake login page harvesting your credentials rather than a file trying to run code. Some attacks use both in the same email, an attachment that also contains a link, or a link that triggers a download.

Neither approach alone covers everything. That's not a flaw, it's just how the threat landscape is shaped. Good email security layers both, because the bad actors are counting on you only checking one.

And if you're trying to understand what's happening at the scanning layer before your email even arrives, the antivirus engine question is worth reading next.