MicrosoftOne thing we have noticed is that if Office 365 ATP takes ages to detonate and check an attachment (15 mins plus is not uncommon here; we're an engineering company that deals with big PDFs and Office files all the time, often with big hairy macros embedded), it takes roughly the same time again if the recipient then forwards it to someone new. Perhaps EOP or ATP could record a checksum, and then ATP could say "Ah, I just processed exactly that file within that last few hours, no point doing it again so soon". Or would that open up a new risk (timestamp-based malware behaviour perhaps)?
