Why Email Attachments Are a Security Risk

Sending a document as an email attachment feels like handing someone a piece of paper. It is closer to photocopying that paper, mailing copies to several buildings you have never visited, and losing the ability to ask for any of them back.

That is not a criticism of email. Email is a store-and-forward system designed in the 1970s to be resilient, not confidential. The problem is that we kept using it for contracts, medical records, and cap tables long after the stakes changed.

What happens to an attachment after you send it

The moment you hit send, the file is copied. It lands in your sent folder, in your mail provider’s storage, in the recipient’s inbox, in their provider’s storage, and in whatever backup systems sit behind both. If the recipient forwards it, that set doubles. If they reply-all, it multiplies.

None of those copies are under your control. You cannot expire them, count them, or withdraw them. There is no mechanism in the protocol for "I sent that to the wrong person" — the closest thing most people have is a recall feature that only works inside a single organisation, and often not even then.

• You cannot tell whether the file was opened, by whom, or how many times.
• You cannot revoke access after sending, even seconds later.
• You cannot stop forwarding, and you will not know it happened.
• Copies persist in backups long after the business reason has passed.

The wrong-recipient problem is the common one

Dramatic breaches get the headlines, but the everyday failure is mundane: autocomplete picks the wrong contact. One character of a surname, and a salary review goes to a client instead of a colleague.

What makes this expensive is not the mistake — people will always misfire occasionally — it is that email offers no way to undo it. A system that assumes humans never err will fail every time a human does.

Shared drives solve the wrong half

The usual next step is a shared drive link. That does fix persistence: revoke the link and the file stops resolving. But it usually trades one problem for another, because the recipient now needs an account, a login, sometimes a licence — and for a client, a candidate, or a patient, that friction is often enough to push everyone back to attachments.

The useful properties are: the sender keeps control, and the recipient does nothing but click. Most tools give you one or the other.

What to look for instead

Whatever tool you choose, the questions worth asking are the same ones email answers badly.

• Can access expire on its own, by date or by number of opens?
• Can I revoke it after the fact, and does that take effect immediately?
• Can I see who opened it and when, in a record I could show someone later?
• Does the recipient need an account, or can they just open the link?
• Can I add a second factor — a password, or a verified email address — when the contents justify it?

Capsule was built around those five questions. Links expire, views can be capped, access can be revoked instantly, every open is recorded, and recipients never need an account. For the most sensitive material you can also encrypt the contents in your browser, so the ciphertext is all our servers ever hold.

The point is not that email is broken. It is that email is a delivery system being asked to do a control system’s job.