Threat protection in documents

A method comprising:

• analyzing a document to generate a batch of links in the document stored on a computer, wherein the document is received as an attachment to an incoming message and is opened using a software that is associated with the work identity;
• calling a threat protection client module with the batch of links;
• receiving the batch of links with their associated URLs, wherein one or more links of the batch of links directed to a malicious URL are associated with a URL of a warning page;
• and
• caching the batch of links with their associated URLs.

A physical article of manufacture including one or more tangible computer-readable storage media, encoding computer-executable instructions for executing on a computer system a computer process, the computer process comprising:

• determining that a link in a document is selected, wherein the document is received as an attachment to an incoming message, stored on a machine with a work identity, and opened on the machine using a software that is associated with the work identity;
• in response to determining that a link in a document is selected, calling a threat protection client module with the selected link;
• receiving an indication from the threat protection client module that the selected link is directed to a malicious universal resource locator (URL);
• and
• in response to receiving the indication that the selected link is directed to a malicious URL, sending a URL of a warning page to the document.