A computer-implemented method comprising: intercepting (201, 505) an email in transit to an email server; performing (202, 510) an initial analysis of the email; based on the initial analysis: generating at least one unique link (302-304, 352) for reporting suspicious content associated with the email; and generating (203, 520) an email warning tag (301, 351) comprising text information and the at least one unique link (302-304, 352) for reporting the suspicious content associated with the email; injecting (204, 525) the email warning tag (301, 351) into the email, wherein injecting (204, 525) the email warning tag (301, 351) into the email produces a modified email comprising content from the email and the email warning tag (301, 351); sending (205, 530) the modified email comprising the content from the email and the email warning tag (301, 351) to the email server; receiving, from a user device (130A-B) associated with an email address specified by the email, a selection of the at least one unique link in the email warning tag (301, 351); identifying, based on information in the at least one unique link, a particular organization associated with the email; retrieving an email policy associated with the organization; and performing a further analysis on the email in response to the selection of the at least one unique link, wherein the further analysis is more computationally intensive than the initial analysis and is based on the email policy associated with the organization. intercepting (201, 505) an email in transit to an email server; performing (202, 510) an initial analysis of the email; based on the initial analysis: generating at least one unique link (302-304, 352) for reporting suspicious content associated with the email; and generating (203, 520) an email warning tag (301, 351) comprising text information and the at least one unique link (302-304, 352) for reporting the suspicious content associated with the email; generating at least one unique link (302-304, 352) for reporting suspicious content associated with the email; and generating (203, 520) an email warning tag (301, 351) comprising text information and the at least one unique link (302-304, 352) for reporting the suspicious content associated with the email; injecting (204, 525) the email warning tag (301, 351) into the email, wherein injecting (204, 525) the email warning tag (301, 351) into the email produces a modified email comprising content from the email and the email warning tag (301, 351); sending (205, 530) the modified email comprising the content from the email and the email warning tag (301, 351) to the email server; receiving, from a user device (130A-B) associated with an email address specified by the email, a selection of the at least one unique link in the email warning tag (301, 351); identifying, based on information in the at least one unique link, a particular organization associated with the email; retrieving an email policy associated with the organization; and performing a further analysis on the email in response to the selection of the at least one unique link, wherein the further analysis is more computationally intensive than the initial analysis and is based on the email policy associated with the organization.