Post-click detection is security monitoring that focuses on what happens after a user interacts with a malicious email, link, or attachment. Instead of only blocking threats at the inbox or gateway, it watches for follow-on activity such as unusual script execution, suspicious PowerShell or command-line behavior, new browser downloads, credential prompts, or unexpected connections to attacker infrastructure.
This matters because many phishing and espionage campaigns succeed only after the victim clicks. A message may look harmless until the user opens a file, enables macros, or signs in to a fake page. Post-click detection helps defenders catch the attack at that point, even if the lure bypassed initial filtering. In practice, it is used with email security, endpoint telemetry, and identity logs to correlate the click with the next steps of compromise and trigger rapid response.