A method, comprising: at a computing platform comprising at least one processor , a communication interface , and memory : receiving , by the at least one processor , via the communication interface , from a first user computing device , a first request for a first uniform resource locator included in a first email message; identifying , by the at least one processor , that the first uniform resource locator included in the first email message corresponds to a first potentially-malicious site; in response to identifying that the first uniform resource locator included in the first email message corresponds to the first potentially-malicious site, determining , by the at least one processor , a risk profile associated with the first request received from the first user computing device ; and based on the risk profile associated with the first request received from the first user computing device , executing , by the at least one processor , an isolation method to provide limited access to the first uniform resource locator included in the first email message; wherein executing the isolation method to provide limited access to the first uniform resource locator included in the first email message comprises initiating a browser mirroring session with the first user computing device to provide the first user computing device with limited access to the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message; and characterised in that the browser mirroring session opens the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message on a cloud browser executing on an isolation server and mirrors safe content on a local browser executing on the first user computing device by mirroring the document object model loaded on the cloud browser at the local browser. receiving , by the at least one processor , via the communication interface , from a first user computing device , a first request for a first uniform resource locator included in a first email message; identifying , by the at least one processor , that the first uniform resource locator included in the first email message corresponds to a first potentially-malicious site; in response to identifying that the first uniform resource locator included in the first email message corresponds to the first potentially-malicious site, determining , by the at least one processor , a risk profile associated with the first request received from the first user computing device ; and based on the risk profile associated with the first request received from the first user computing device , executing , by the at least one processor , an isolation method to provide limited access to the first uniform resource locator included in the first email message; wherein executing the isolation method to provide limited access to the first uniform resource locator included in the first email message comprises initiating a browser mirroring session with the first user computing device to provide the first user computing device with limited access to the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message; and characterised in that the browser mirroring session opens the first potentially-malicious site corresponding to the first uniform resource locator included in the first email message on a cloud browser executing on an isolation server and mirrors safe content on a local browser executing on the first user computing device by mirroring the document object model loaded on the cloud browser at the local browser. <EOS>