Whenever the user opens an e-mail message that fits the filter parameters, the IronPort system rewrites the malicious URLs embedded in those messages to go through Cisco’s ScanSafe Cloud Web Security system. If the user still goes ahead and clicks on the rewritten link, the Web content is passed through additional Cisco filters in the cloud security service which scans and identifies any potential malware that may be on the site and blocks them from downloading when necessary.
Link
