Sometimes, the Email Security - Cloud appliance delivers an email to end users containing a URL not currently known to be malicious. If the URL is later determined to be malicious, a retroactive alert is generated. You can also search for retroactive alerts by using the Retro alert type filter.
Retroactive alerts can also be generated by remediation policies. For more information, see Managing remediation policies.