Proofpoint jumps into security services fray

Joining the trend of providing security technology as a service, Proofpoint on Tuesday announced a hosted version of its messaging-security offering.

Company officials say Proofpoint on Demand offers enterprises the same antispam, antivirus and e-mail policy enforcement, and outbound-content monitoring as the company's existing appliance and software, but without the management headache of having to run appliances or software in-house.

The company says it will distinguish itself in the expanding market for hosted messaging-security services -- currently including Postini (which Google last month announced it plans to acquire), Microsoft, Symantec, Trend Micro, McAfee, MessageLabs, and others -- by offering more flexible configurations. Customers of the new service will be able to mix and match components that include antispam, antivirus and zero-hour antivirus software; acceptable-use policy enforcement; outbound content filtering and others, the company says.

Traditionally, hosted e-mail security services have appealed more to small and midsize businesses -- which don't have the IT staff to manage an appliance or software in-house -- than to large enterprises that tend to prefer the control achieved with administering such systems themselves. That's beginning to change, says Michael Osterman, president of Osterman Research.

"Some [enterprises] are finding it cheaper to use a hosted service; you get a lot more flexibility and you're not as locked into the vendor," Osterman says. In addition, many large companies are seeking a hybrid approach where they could, for example, run an e-mail security appliance at headquarters, where the bulk of the IT staff is, but deploy hosted services in smaller offices, he says.

This is why many messaging-security vendors now are offering their products as software, appliances or hosted services, as they attempt to cater to whichever method of delivery enterprises prefer. Proofpoint also sells a virtual version of its appliance; that is another trend in the messaging-security market.

The antispam features in Proofpoint's new service come from the company's MLX technology, which leverages reputation services and content filters to block image and traditional spam and phishing attacks, company officials say. For virus protection, customers can chose from products supplied by F-Secure or McAfee, while Proofpoint's own Zero-Hour Antivirus module blocks threats in the very early stages before signatures have been released, they say.

According to the company, Proofpoint on Demand's Content Compliance module helps administrators define and enforce acceptable use policies about file type, message size and message content for inbound and outbound messages. The Data Leak Prevention module prevents sensitive information from leaving an organization without authorization, and the Regulatory Compliance module uses dictionaries and smart identifiers to flag sensitive content and protect data covered by federal or industry regulations or corporate policies. Going one step further, the Digital Asset Security module uses machine-learning technology to analyze and classify sensitive information, then monitors outbound messages for that data, company officials say.

All modules are administered via Proofpoint's Web-based interface that offers a unified policy framework, generates customized reports and feeds status information, company officials say.

Proofpoint on Demand is available and is priced per user, per year, depending on which modules a customer chooses. For example, a company with 1,000 users that chooses spam and virus protection and the Content Compliance module would pay US$20,000 a year.