Does Anyone Care About Spam Catch Rates Anymore?

Blocking spam is the top job of your email security solution. When it is not working well, the user complaints come flying in. An effective anti-spam solution is critically important to have, but are spam catch rates the important criteria for selecting an email security solution? Not anymore.

Virus Bulletin recently published its January anti-spam comparative results. The report shows some great test results for many email security vendors, most of them earning the “VB Verified” award. The criteria for becoming “VB Verified” is based upon the product’s spam catch rate (SC) minus five times the false positive (FP) rate. The resulting score must be better than 97 to earn the award (SC – 5xFP > 97). Eighteen of the twenty products tested earned the VB Verified designation.

What is this telling us? This points to the fact that anti-spam technology is doing a good job at keeping email clutter-free. However, blocking +99% of spam isn’t “market leading” anymore. It has become an expected standard for all email security vendors. I talk to customers and prospects every day, and I can’t remember the last time I was asked about the spam catch rate for our products. It’s an expectation that our products do the job and do it well.

Questions about spam catch rates have been replaced with questions about policy enforcement, outbound email inspection capabilities, email quarantine management, encryption, scalability, manageability, software as a service (SaaS) and virtual appliance deployment options. These are the features and capabilities that differentiate email security solutions today, as these are key to improving efficiency, security and overall cost of the solution.

Perhaps the hottest topic lately has been around Data Loss Prevention (DLP). Specifically, what DLP features are integrated into the email solution and how do these features integrate with full-featured DLP solutions? These questions are originating from organizational efforts for regulatory compliance and protection of sensitive data. Many businesses are funding projects to implement content controls and email is one of the first (and easiest) places to start implementing DLP policies. As a result, DLP capabilities have risen to become  a very high priority requirement for email security initiatives.

So is the spam problem solved? Not quite, but with any decent solution, you should be able to block more than 99% of it. The real value of your email solution is the additional features that it provides. Some vendors will continue to boast about beating the others in spam catch rate.  As we can see in the Virus Bulletin January anti-spam comparative results, vendors that are relatively unknown in market have posted catch rates that are tenths of percentage points higher than some of the top-tier vendors in the market. That’s great for them, but doesn’t mean they should be added to your short list for email security vendors.

Again, no one ever asks “what is your spam catch rate?” anymore. Catch rates are important. However, “What else do you have for me?” is the question now being asked.  When an email security vendor is pitching you on their product by saying it is #1 in spam catch rates, that might be a good indication that they don’t have much else to offer.

Tags: Compliance, DLP, Email & Web Security, Risk and Compliance, spam