One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
- receive, via the communication interface, from a first user computing device, a first request for a first uniform resource locator associated with a first email message;
- identify that the first uniform resource locator associated with the first email message corresponds to a first potentially-malicious site;
- in response to identifying that the first uniform resource locator associated with the first email message corresponds to the first potentially-malicious site, determine a risk profile associated with the first request received from the first user computing device;
- and
- based on the risk profile associated with the first request received from the first user computing device, execute an isolation method to provide limited access to the first uniform resource locator associated with the first email message.