Nearly all business professionals and managers rely upon email for business communications. Yet unsolicited email messages--broadly known as spam--threaten the effectiveness of email as a communications medium. In addition, spam is well-recognized as a vector for introduction of viruses, worms, and other forms of malware into the organization. In response, nearly every organization has adopted some form of antispam technology.

To determine whether businesses are winning the war against spam we recently conducted a survey of 112 professionals, broken down as follows:

• Managers that approve IT investments (42)
• IT professionals responsible for email systems or IT security (37)
• Users of email not in the above categories (33)

We were interested in whether, in the view of the respondents, dealing with spam has become more difficult or less difficult in the past year. We also gathered statistics regarding the types of spam-blocking technologies employed, and whether the respondent's view on the war against spam differed according to which technologies were employed. Finally, we wanted to review the primary justification for investments in anti-spam technology in the minds of the managers that approved them.

This Research Byte is a summary of our full report, The Relative Effectiveness of Spam-Blocking Solutions.

Are We Winning the Battle Against Spam?
When taken as a whole, our survey respondents were about equally divided on the question of whether we are gaining ground in the battle against spam, as shown in Figure 1. Forty-five percent of respondents said that dealing with spam this year is more difficult than last year, 42% said it is less difficult, and 13% said it is about the same.

The full version of this report also provides a breakdown, by job function, of perceptions on progress being made against spam, showing the difference of opinion for managers, email administrators and IT security professionals, and users in general, along with an analysis of the reasons for these differences.

Types of Spam-Filtering Products Deployed
Next, we asked respondents what type of spam-blocking or filtering technologies were deployed within their organization, according to four categories:

• Client-based products, such as Spamihilator, Spam Bully, and SpamBayes.
   
• Server-based products, such as Antigen, Tumbleweed, and GFI Mail Essentials. 
   
• Spam appliances, which are separate hardware devices that sit between the organization's mail servers and its ISP, such as those offered by Barracuda Networks, Tumbleweed, and Mirapoint.
   
• Third-party service providers that filter spam before it reaches the organization's mail servers. Examples include Barracuda Managed Services, AppRiver, MX Logic, and NuXo.

As shown in Figure 3, our sample was equally represented by these four main categories of spam-blocking technology. Note, however, that some organizations deploy more than one category of spam-filters. The full report analyzes the effectiveness of the multi-product approach versus use of a single product. 

Understanding which types of spam-blocking technologies were present in each organization then allows us to determine whether there are differences in the respondents' views according to which type of spam-blocking products are in use.

As it turns out, opinions on whether efforts to filter spam are succeeding vary significantly according to which type of spam-filtering is employed. The full version of this report analyzes each category of spam-blocking software shown in Figure 3. Results are reported in terms of the percentage of respondents using that category that say dealing with spam is getting easier versus those NOT deploying that type of spam-filtering that say dealing with spam is getting easier.

Justification for Investments in Spam-Blocking Technology
Finally, we wanted to understand the primary reason that executives approve investments in anti-spam products. In asking this question, we gave respondents four choices:

• Spam affects executives directly so they make spam-blocking/filtering a high priority.
   
• Executives understand the direct financial benefits of spam-blocking/filtering technology.
   
• Spam-blocking/filtering products work well and the price is reasonable.
   
• Executives understand that spam is often a vector/vehicle for security threats such as viruses and phishing attacks.

Although we asked this question of all respondents, we were most interested in the responses from the managers that actually approve such investments.

As shown in Figure 9, in the mind of executives that sign off on technology investments, there were two leading reasons that they approved acquisition of new products to filter spam. First, 32% of executives admitted that they make spam-blocking/filtering a high priority because it affects them directly. However, an equal number of executives claim the primary reason to be that they understand the risk of spam as a vector or vehicle for security threats.

These results suggest that IT organizations that want to obtain approval for new spam-fighting technology are best advised to highlight the impact that spam has on users, reminding executives of their own experiences with battling spam. In addition, executives appear cognizant of the security threats involving spam. Therefore, highlighting the risk reduction benefits of spam-fighting are also likely to receive a favorable response.

On the other hand, fewer executives appear as persuaded by simple cost-benefit arguments. This line of justification--although often favored by technology vendors--does not appear to be as persuasive in the mind of executives: only 24% indicate that direct financial benefits were the primary reason for approving spam-fighting technology, and only 3% felt that the cost of such products was low enough to warrant approval without formal justification.

The full version of this report also includes practical recommendations for succesful deployment of spam-blocking technology, based on the results of this study.

September 2006