Dynamically controlling access to linked content in electronic communications

A method, comprising:

• at a computing platform comprising at least one hardware processor, a communication interface, and memory:
• receiving, by the at least one processor, via the communication interface, from a first user computing device associated with an enterprise organization, a first request to open a first uniform resource locator associated with a first email message;
• identifying, by the at least one processor, that the first uniform resource locator associated with the first email message corresponds to a first potentially-malicious site;
• in response to identifying that the first uniform resource locator associated with the first email message corresponds to the first potentially-malicious site, determining, by the at least one processor and based on features of the first uniform resource locator, a risk profile for the first request to open the first uniform resource locator received from the first user computing device, wherein determining the risk profile associated with the first request to open the first uniform resource locator received from the first user computing device includes identifying a web category associated with the first uniform resource locator and determining that the first uniform resource locator associated with the first email message is associated with a specific web category by matching header content of a page corresponding to a site associated with the first uniform resource locator with information defined in one or more category templates, wherein determining the risk profile further includes identifying a predetermined score value corresponding to the specific web category, from a plurality of predetermined score values, each predetermined score value corresponding to a different respective web category, and comparing the identified predetermined score value with one or more predetermined thresholds to determine a level of risk associated with the first request;
• and
• based on the risk profile associated with the first request to open the first uniform resource locator received from the first user computing device, executing, by the at least one processor, an isolation method to provide limited access to the first uniform resource locator associated with the first email message.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one hardware processor, a communication interface, and memory, cause the computing platform to:

• receive, via the communication interface, from a first user computing device associated with an enterprise organization, a first request to open a first uniform resource locator associated with a first email message;
• identify that the first uniform resource locator associated with the first email message corresponds to a first potentially-malicious site;
• in response to identifying that the first uniform resource locator associated with the first email message corresponds to the first potentially-malicious site, determine, based on features of the first uniform resource locator, a risk profile for the first request to open the first uniform resource locator received from the first user computing device, wherein determining the risk profile associated with the first request to open the first uniform resource locator received from the first user computing device includes identifying a web category associated with the first uniform resource locator and determining that the first uniform resource locator associated with the first email message is associated with a specific web category by matching header content of a page corresponding to a site associated with the first uniform resource locator with information defined in one or more category templates, wherein determining the risk profile further includes identifying a predetermined score value corresponding to the specific web category, from a plurality of predetermined score values, each predetermined score value corresponding to a different respective web category, and comparing the identified predetermined score value with one or more predetermined thresholds to determine a level of risk associated with the first request;
• and
• based on the risk profile associated with the first request to open the first uniform resource locator received from the first user computing device, execute an isolation method to provide limited access to the first uniform resource locator associated with the first email message.