Check
Rule
External links without context
An unexplained outside link looks exactly like phishing, and your security team has spent years teaching people not to click it.
The prompt
Flag any link to a site outside the company’s own domains that is not introduced with what it is and why the reader should open it. A bare URL is a violation. ‘Our benefits provider’s enrollment guide (PDF)’ is fine. Footer social icons are exempt.
Works in
ConfidenceCheckHow to use
List your own domains and trusted vendors ('[company].com', '[benefits-vendor].com') so links to them are not treated as external.
Where: Settings → Email Settings → Custom Check (Owners and Admins)
In packs: Regulated industry · Global and multi-region
The prompt
Flag any link to a site outside the company’s own domains that is not introduced with what it is and why the reader should open it. A bare URL is a violation. ‘Our benefits provider’s enrollment guide (PDF)’ is fine. Footer social icons are exempt.
