When would the tool scan attachments for viruses and malware? During, post upload or scheduled?

Scan happens before/ in real-time, it actually uploads into the platform.