A computer implemented method of an email security system for processing email messages, the method comprising: intercepting, by an email server, an email message directed to a recipient prior to delivery thereto; in response to receiving an email message, detecting, by a processor of the email security system, one or more artifacts within the email message, wherein each of the artifacts is associated with a payload; for each artifact, generating, by the processor: a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and generating, by the processor of the email security system, an artifact dashboard and transmitting only the artifact dashboard to an administrator computer operated by an administrator; presenting, by a processor of the administrator computer, the artifact dashboard in a graphical user interface rendered on a display of the administrator computer, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact, determining, by the processor of the administrator computer, whether each of the at least one payload button has been interacted with by the administrator via the GUI to cause the associated payload to be transmitted to the external system for analysis, marking as complete a review of the email message only once it has been determined that the administrator has interacted with all of the at least one payload buttons; determining, by the email security system, whether a response has been received from the administrator, to authorize or not authorize forwarding of the email message to the recipient; transmitting the email message to the recipient upon receiving the response authorizing forwarding of the email message to the recipient; not transmitting and quarantining or deleting the email message to the recipient upon receiving the response not authorizing forwarding of the email message to the recipient; and wherein, if the email security system does not receive a response authorizing forwarding of the email message to the recipient with a threshold amount of time, quarantining the email message upon expiration thereof. intercepting, by an email server, an email message directed to a recipient prior to delivery thereto; in response to receiving an email message, detecting, by a processor of the email security system, one or more artifacts within the email message, wherein each of the artifacts is associated with a payload; for each artifact, generating, by the processor: a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and generating, by the processor of the email security system, an artifact dashboard and transmitting only the artifact dashboard to an administrator computer operated by an administrator; presenting, by a processor of the administrator computer, the artifact dashboard in a graphical user interface rendered on a display of the administrator computer, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact, determining, by the processor of the administrator computer, whether each of the at least one payload button has been interacted with by the administrator via the GUI to cause the associated payload to be transmitted to the external system for analysis, marking as complete a review of the email message only once it has been determined that the administrator has interacted with all of the at least one payload buttons; determining, by the email security system, whether a response has been received from the administrator, to authorize or not authorize forwarding of the email message to the recipient; transmitting the email message to the recipient upon receiving the response authorizing forwarding of the email message to the recipient; not transmitting and quarantining or deleting the email message to the recipient upon receiving the response not authorizing forwarding of the email message to the recipient; and wherein, if the email security system does not receive a response authorizing forwarding of the email message to the recipient with a threshold amount of time, quarantining the email message upon expiration thereof.