Kesner’s cautious approach of testing on duplicate messages allowed him to get a real-world read on false positive ratings without worrying about losing any legitimate messages.

The Outsourcing Option

Kesner’s testing convinced him that the ability to filter out most spam while maintaining an extremely low false positive rate was worth the risk of outsourcing. "I was cautious of an outside service," he says. "But [being an outsourcer] allows them to respond to spam outbreaks faster than their competitors." Sending out a spam update to thousands or millions of remote users is taxing, so spam software makers tend to roll these updates into packages and send them periodically. A service provider can simply add an update to a few servers in a couple minutes and have the update apply to all customers nearly instantly.

Postini also lets Fenwick & West IT employees choose how much of each kind of spam they want to filter out by setting filters for each of four subcategories of spam: explicit content, get rich quick, too good to be true and racially insensitive. Kesner pays a per-user fee, which turned out to be about half of what he’d budgeted for. And because he’s now blocking at least 99 percent of incoming spam (5,000 to 7,000 messages a day get trapped on Postini’s servers), Kesner has been able to delay the purchase of four new servers (costing $10,000 to $20,000 each) by more than six months.

Indeed, using an outsourcer can be cheaper than managing the spam problem internally. Water Pik, which manufactures personal health-care products, pool products and heating systems, also found that to be the case. "We looked at the cost of doing it internally, and it was staggering," says CIO Wallace Miceli. "We’re talking one or two people full-time," he says. Miceli pays FrontBridge $1.50 per month for each of his 1,000 users, which he says is cheaper than buying and maintaining an onsite filter.

Outsourcing, however, won’t work for everyone. Large companies, those with multiple locations whose mail doesn’t all pass through one or two points, and those that use both private and public networks, may find it tricky to outsource. And the obvious downside of outsourcing is that it requires giving someone else the authority to decide what e-mail enters your organization. "For a spam filter to work very effectively, it has to look to a certain extent at the body of the message," says John Mozena, a cofounder of the Coalition Against Unsolicited Commercial Email (CAUCE). "Something—even if it’s just a piece of software—is reading your company’s mail. For some companies, that is not acceptable." Law firms and hospitals, for example, might be wary of exposing confidential client or patient e-mail to a third party.