A method, comprising: at a computing platform comprising at least one processor, a communication interface, and memory: receiving (205, 905), by the at least one processor, via the communication interface, from a first user computing device, a first request for a first uniform resource locator included in a first email message; identifying (206, 910), by the at least one processor, that the first uniform resource locator included in the first email message corresponds to a first potentially-malicious site; in response to identifying (206, 910) that the first uniform resource locator included in the first email message corresponds to the first potentially-malicious site, determining (207, 915), by the at least one processor, a risk profile associated with the first request received from the first user computing device; and based on the risk profile associated with the first request received from the first user computing device, executing (208, 920), by the at least one processor, an isolation method to provide limited access to the first uniform resource locator included in the first email message; wherein executing (208, 920) the isolation method to provide limited access to the first uniform resource locator included in the first email message comprises initiating a browser mirroring session with the first user computing device to provide the first user computing device with limited access to the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message; and characterised in that the browser mirroring session opens the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message on a cloud browser executing on an isolation server and mirrors safe content on a local browser executing on the first user computing device by mirroring the document object model loaded on the cloud browser at the local browser. receiving (205, 905), by the at least one processor, via the communication interface, from a first user computing device, a first request for a first uniform resource locator included in a first email message; identifying (206, 910), by the at least one processor, that the first uniform resource locator included in the first email message corresponds to a first potentially-malicious site; in response to identifying (206, 910) that the first uniform resource locator included in the first email message corresponds to the first potentially-malicious site, determining (207, 915), by the at least one processor, a risk profile associated with the first request received from the first user computing device; and based on the risk profile associated with the first request received from the first user computing device, executing (208, 920), by the at least one processor, an isolation method to provide limited access to the first uniform resource locator included in the first email message; wherein executing (208, 920) the isolation method to provide limited access to the first uniform resource locator included in the first email message comprises initiating a browser mirroring session with the first user computing device to provide the first user computing device with limited access to the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message; and characterised in that the browser mirroring session opens the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message on a cloud browser executing on an isolation server and mirrors safe content on a local browser executing on the first user computing device by mirroring the document object model loaded on the cloud browser at the local browser.