> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Content scanners (CS) - URL: /taxonomies/email-infrastructure/content-scanners/ - Published: 2026-10-31T13:00:00.000Z - Updated: 2026-10-29T14:53:58.534Z - Description: Content scanners (CS): 13 threats in the email infrastructure threat taxonomy, with mitigations. URL, malware, sandbox, ML and LLM inspection engines. - Author: Brett Crawley [Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › Content scanners **Layer 07 of 09 · 13 threats · prefix CS** A scanner is a probabilistic control that an attacker can study, evade and attack directly. These entries cover URL analysis, malware detection, sandboxes, machine learning (ML) and large language model (LLM) classifiers, and data loss prevention (DLP). **Scope:** URL, malware, sandbox, ML and LLM inspection engines. ![Table: Content scanners (CS), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/100/email-taxonomy-table-07-CS.png =1400x4163) *Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.* ## The threats - **CS·A** Analysis-Aware Content - **CS·K** Scanner Prompt Injection - **CS·Q** Gated Content - **CS·J** Reputation Laundering - **CS·10** Classifier Evasion - **CS·9** Classifier Poisoning - **CS·8** Scanner as Attack Surface - **CS·7** Scanner Side Effects - **CS·6** Verdict Oracle - **CS·5** Novelty Window - **CS·4** Modality Gap - **CS·3** Scanned Data Exposure - **CS·2** Exemption Abuse ## Where this layer touches others - **Delivery pipeline and content scanners:** the pipeline decides what to do with a scanner's limits and verdicts. The scanner layer asks whether the inspection itself holds up. ## STRIDE, CAPEC and CWE Of the 13 entries here, STRIDE fits 5 cleanly and 8 only loosely. CAPEC 3.9 has a pattern that describes 1 of them directly, only a generic parent pattern for 5, and nothing for 7. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 5, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text. ![Table: STRIDE, CAPEC and CWE mapping for Content scanners (CS), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/100/email-mapping-table-07-CS.png =1400x2098) --- ← [DNS layer (DN)](/taxonomies/email-infrastructure/dns-layer/) · [Email infrastructure overview](/taxonomies/email-infrastructure/) · [Human-facing layer (HF)](/taxonomies/email-infrastructure/human-facing-layer/) → *© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*