A method for processing a data package to be sent to an addressed recipient, the method comprising the steps of: obtaining a data package to be sent over a data network, the data package comprising payload data and a header; temporarily storing the data package in temporary storage; analysing, at a first time, the header of the data package to determine a plurality of characteristics, the header comprising at least information relating to an addressed recipient, and the plurality of characteristics comprising at least a recipient identifier and a transmission time, and determining, using at least one data model, at least one probability value associated with a relationship between the plurality of characteristics; generating a risk indicator based on the at least one probability value; processing the data package, wherein the processing comprises: determining a handling action for the data package, wherein the handling action is based on the risk indicator; applying the handling action to the data package to generate a processed data package; transmitting the processed data package to the addressed recipient; and; determining whether to update the at least one data model at the first time based, at least in part, on whether the risk indicator is being generated at the first time, and based on the determination: updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and retrieving the data package from temporary storage, and updating based on the data package, at a second time later than the first time, the at least one data model, when it is determined that the at least one data model should not be updated at the first time, and the risk indicator has been generated at the first time. obtaining a data package to be sent over a data network, the data package comprising payload data and a header; temporarily storing the data package in temporary storage; analysing, at a first time, the header of the data package to determine a plurality of characteristics, the header comprising at least information relating to an addressed recipient, and the plurality of characteristics comprising at least a recipient identifier and a transmission time, and determining, using at least one data model, at least one probability value associated with a relationship between the plurality of characteristics; generating a risk indicator based on the at least one probability value; processing the data package, wherein the processing comprises: determining a handling action for the data package, wherein the handling action is based on the risk indicator; applying the handling action to the data package to generate a processed data package; transmitting the processed data package to the addressed recipient; and; determining whether to update the at least one data model at the first time based, at least in part, on whether the risk indicator is being generated at the first time, and based on the determination: updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and retrieving the data package from temporary storage, and updating based on the data package, at a second time later than the first time, the at least one data model, when it is determined that the at least one data model should not be updated at the first time, and the risk indicator has been generated at the first time. determining a handling action for the data package, wherein the handling action is based on the risk indicator; applying the handling action to the data package to generate a processed data package; transmitting the processed data package to the addressed recipient; and; determining whether to update the at least one data model at the first time based, at least in part, on whether the risk indicator is being generated at the first time, and based on the determination: updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and retrieving the data package from temporary storage, and updating based on the data package, at a second time later than the first time, the at least one data model, when it is determined that the at least one data model should not be updated at the first time, and the risk indicator has been generated at the first time. updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and retrieving the data package from temporary storage, and updating based on the data package, at a second time later than the first time, the at least one data model, when it is determined that the at least one data model should not be updated at the first time, and the risk indicator has been generated at the first time.