How does quarantine differ from deletion?

Quarantine isolates suspicious messages for review while preserving them. Administrators or users can release legitimate messages or confirm threats. Quarantine provides safety with recovery option.

Deletion removes messages permanently. No recovery possible if legitimate messages are incorrectly deleted. Deletion is appropriate for confirmed threats but risky for borderline cases.

Quarantine is preferred for: messages flagged by probabilistic detection, new threat patterns with uncertain classification, and organizations needing audit trails. Deletion suits: known **malware** signatures, confirmed **phishing** URLs, and high-confidence threats.