Modern email security scans links and attachments at the time of the click, not only on delivery. Sandboxing opens attachments in isolation, and link rewriting checks the destination when the user clicks.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Enable link protection and attachment sandboxing
- Tag external email clearly
- Block risky file types
Making it stick
Filters catch most threats. The rest is why people and processes matter. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.