What is anti-virus scanning in email?

Every email you receive could be carrying something dangerous inside it. Not metaphorically. Literally. A PDF with a script hiding in it, a zip file that unpacks malware, a Word doc with a macro that runs the moment someone clicks enable. Anti-virus scanning in email is the layer that checks for exactly this before a message lands in someone's inbox.

Anti-virus (AV) scanning inspects email messages and their attachments for malware, including viruses, trojans, ransomware, and other malicious payloads. It runs before delivery, not after, which is what makes it useful.

Most scanning systems use a combination of techniques to catch threats:

• Signature matching compares attachment content against a database of known malware. It's fast and reliable for threats that have already been identified.
• Heuristic analysis looks for suspicious patterns and behaviors, even in files that don't match a known signature. A new variant of an old threat might slip past signature matching but still trip heuristics.
• Sandboxing opens the attachment in an isolated environment and watches what it does. If it tries to reach out to a remote server, modify system files, or do anything a legitimate PDF has no business doing, the sandbox catches it. This is the deepest form of scanning, and the slowest.

Now, the honest answer to how deep scanning actually goes: it depends on the system. Basic AV scanning will check the outer file. Better systems will unpack zip files and scan each file inside. The best systems will open PDFs, extract embedded objects, and run them through the same checks. Highly nested archives (a zip inside a zip inside a zip) are a known evasion tactic, because some scanners stop at a certain depth to avoid processing delays.

Password-protected attachments are a real blind spot. If a zip is encrypted, the scanner can't see inside it. Attackers know this, which is why phishing campaigns often send a password-protected zip and then include the password in the email body or a follow-up. Some advanced security systems will actually use that in-body password to try to open and scan the file. Most won't.

When an attachment fails AV scanning, the typical outcome is one of three things: the attachment is stripped and the email delivers without it, the whole message goes to quarantine, or delivery is blocked outright. Which one happens depends on how your organization has configured its email security gateway.

Enterprise security products like Barracuda typically integrate multiple AV engines at once, precisely because no single engine catches everything. Open-source options like ClamAV are common in smaller setups, though they tend to lag on new threat signatures. Products from Sophos, Trend Micro, and similar vendors are common in larger corporate environments.

One more thing worth knowing: AV scanning and sandboxing are often discussed together, but they're not the same thing. AV scanning is fast and runs on every message. Sandboxing is deep and expensive, so it's usually reserved for suspicious files that pass initial checks but still look off. They work as layers, not replacements for each other.

If you're trying to understand why a legitimate attachment is getting flagged or stripped, our SOS hotline is free and we're happy to help you figure out what's triggering it.