Home›Guides›Email security
Email security · Understand
For ANSSI, the French national cybersecurity agency, email is the main vector for infecting workstations: a single attachment or link is enough to let in malware, ransomware included. A filter placed before the mailbox can analyze files and links, remove a dangerous attachment and recheck a link at the time of click. It replaces neither user caution nor a backup the attacker cannot erase.
When an attachment is deemed dangerous, two outcomes are reasonable: remove the attachment and deliver the message with a note explaining why, or quarantine the entire message. Either way, the file does not reach the workstation.
A link is analyzed in the message: reputation of the URL and the domain, resemblance to a well-known brand, recently created domain. QR codes pose a particular problem: they move the link from the computer, which is protected, to the personal phone, which often is less so. Reading the code in the image brings that link back under control.
But a link that is safe at 9 a.m. can be malicious by 2 p.m. Fraudsters first send a link to a harmless page, then change the page once the message has been delivered. That is the reason for time-of-click protection: the link is rewritten so that it goes through a check at the moment the user clicks. If the page has become dangerous, the click is stopped, even though the message was delivered.
More and more malicious messages contain no attachment at all: they point to a document stored on a well-known file-sharing service. The link’s domain then has an excellent reputation, since it belongs to a major service. The analysis has to focus on everything else: is the sender a usual one, does the message look like a campaign, does the page that opens ask for a password? This is where time-of-click checks and detection of unusual behavior matter more than a list of dangerous domains.
Cybermalveillance.gouv.fr describes ransomware as an attack that blocks access to a system or encrypts data, and sometimes threatens to disclose it, in exchange for a ransom. The service notes that the intrusion generally comes through a vulnerability or poorly secured remote access, or through the compromise of an account or machine via phishing or malware.
Email is not the only way in, but ANSSI identifies it as “the main vector for infecting workstations” (translation). The same agency cites “sending malicious attachments to exploit workstation vulnerabilities for ransom or espionage purposes”. It is also an entry point that can be filtered before it reaches the mailbox. The typical sequence by email:
An example, for illustration only. An employee receives an “unpaid invoice” as a Word document. The document displays a blurred banner and asks the user to enable content to read it. If they do, the macro downloads a program that provides access to the workstation. The server files will only be encrypted later. If the attachment is removed on arrival, this chain never starts; if it gets through, everything depends on the reflex of not enabling the macro, and then on the backup.
The gateway acts on the first step. It does not see an intrusion through remote access, or an account already opened with a password stolen elsewhere. It restores nothing.
Cybermalveillance.gouv.fr recommends regular backups, offline copies, tested restores and updates applied without delay. It also recommends not paying the ransom. For your files, the question is covered in ransomware: protecting and restoring a document management system.
Quarantine exists for doubtful cases: the message is neither delivered nor lost. See Quarantine, false positives and reports.
The message arrives with a note explaining the removal. If the attachment was legitimate, the administrator or the recipient goes through the quarantine: see Quarantine, false positives and reports.
Yes: it can contain scripts or lead to a fake login page. That is why it is inspected like an Office document.
The page has changed since delivery. Time-of-click protection assesses the page at the moment you open it.
No. It reduces entry through email. Updates, remote access security and backups do the rest. See ransomware: protecting and restoring a document management system.
How Klytic MTA splits these analyses between its two plans, as published:
| Analysis | Essential | Advanced |
|---|---|---|
| Antivirus and encrypted quarantine | Yes | Yes |
| Malicious Office macros and PDFs | Yes | Yes |
| Anti-phishing, brand impersonation, QR codes | Yes | Yes |
| Dangerous attachments removed, with an informational notice | Yes | Yes |
| Secure release from quarantine and notifications | Yes | Yes |
| Malicious HTML files and text hidden in images | No | Yes |
| Links rescanned at the time of click | No | Yes |
Klytic MTA works in front of any email system, without Klytic Mail. It does not replace the backup of your files and mailboxes: at Klytic, that is handled by the backups of the services themselves, described on the security and backup page.
Consulted in October 2026.
Free 30-day trial of Klytic MTA, in front of your current email system.
Welcome offer
No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.
