Phishing links in e-mails to company employees often become active after initial scanning. But they still can and must be caught.