What’s the difference between attachment scanning and link scanning?

Attachment scanning examines file contents for **malware**. The file is analyzed statically (code patterns) and sometimes dynamically (execution in sandbox). Protection happens before the file reaches the user.

Link scanning checks URL destinations against reputation databases and may fetch pages for content analysis. Some systems rewrite links to route through scanning proxies, checking destinations when clicked.

Both are necessary. Malware can arrive as attachments or via links to downloads. Phishing typically uses links to credential harvesting pages. Comprehensive protection scans both vectors using appropriate techniques.