Each detection type has its own action: log only, delete, or delete plus a timeout, kick or ban. Actions are capped by the confidence of the detection, so a heuristic such as scam wording can never ban anyone. The Security Score expects reviewed and threat-feed links to at least be deleted.
Example
/setup › Find a setting › Phishing feeds