Espionage could be practiced from outside, too. It's called 'cyber-woozling' and it's not apparent to AV tools. Our products will strip out any macros and just give you the document. They've been asking me about corners of the products I've never been asked about before.
Customers here do arrogant things with the products.
For example, they are thinking beyond simply an anti-intrusion function to using the screening software to identify the content of the incoming message and put it in its correct place in an archive. Mention of a country and the company name and a few other key terms will indicate to the screening software, for example, that the message is probably an inquiry as to how to contact the company in that country. The email system can send out an automatic reply to that part of the message, while passing on the rest. A web-crawling robot is no longer flagged as an intruder. The security software can help it with the correct address of the web page people should be visiting, rather than leaving the robot to find a page that may be deep in the structure of the site and confusing for the user of a search engine.