Respond to a suspicious attachment

Understand

Incident response limits harm while preserving evidence. Follow your organisation's process; don't delete evidence or experiment with unknown files.

Example

Made-up scenario: a colleague reports an unexpected attachment and a security warning. You have not opened the file.