In Links and external images, you can define security rules that will be applied to links and images inside received messages in order to protect your team from phishing attempts:

Most of the time, you should select Enable all settings to enable all the security features and get new ones enabled as soon as they become available. Disable all settings is usually only used when you are using a third-party service to handle your inbound security.

You can also choose to Customize settings and select just the measures you are interested in. If you enable Identify links behind shortened URLs, Google will look where they would take the user to identify malicious content, while Scan linked images will analyze images and try to identify malicious content.

You can also choose to Show warning prompt for any click on links to untrusted domains to warn users every time they try to click on links that would take them to any non-whitelisted domain.