SaaS Security Control (Exchange Online ATP Safe Attachment)

Hi, how does SaaS Security API in details work? Does ZScaler scan attachment in intervals?
How ZScaler handles if the mail still is not present in mailbox because of ATP Safe Attachment Scan. Some times the attachment is not directly available because of sandbox scan of the attachment. The attachment is dynamically attached after scan to the new mailbox mail item afterwards.
Does ZScaler can recognize this?
I want to ensure that if the new mail item is scanned it will wait till all attachments are presented.