Compare Cisco 

• WatchGuard XCS 170, 370 and 570 appliances have been specifically designed for small to medium businesses to protect from email threats and prevent outbound data loss at an affordable price.

• These set‐and‐forget appliance models are built on the same enterprise‐class bi‐directional email security and data loss prevention capabilities of the XCS enterprise models and include the WatchGuard XCS defense‐in‐depth protection built on its proprietary 15+ year proven technology.

PERFORMANCE

• XCS delivers the highest performance in the industry, a fact that is constantly being demonstrated in head‐to‐head competitive situations where real‐world messages are being processed and delivered.

• XCS has been specifically architected to eliminate the processing bottlenecks that plague our competitors.

• Performance is enhanced by including ReputationAuthority, WatchGuard’s next‐generation reputation service, which eliminates more than 98% of all inbound threats at the connection level, resulting in better performance because it frees the system to process only legitimate, clean traffic.

• The on‐demand and zero‐admin clustering capabilities of XCS is designed to scale to meet the needs of any sized organization.

• XCS is the only product that protects every message against loss using its patented queue replication technology.

While Cisco is well touted for its high performance, its products rely on most of the messages being dropped by SenderBase. SenderBase relies on IP history and volume to assign a reputation score, resulting in an 80% (at best) block rate. This would mean that in a scenario where 1M messages are attempting to establish an SMTP connection, 200,000 messages would be cleared by SenderBase to enter the network. In comparison, WatchGuard's reputation service (ReputationAuthority) uses next‐generation technology that extends its filtering beyond DNSBL and volume to inspect the behavior of an IP and the content of the message before it assigns a reputation score. As a result, it is able to block more than 95% of unwanted traffic at the perimeter. As in the example above, where 1M messages are attempting to establish an SMTP connection, only 50,000 messages would be pushed through the XCS appliance for further examination and threat prevention.

SPAM DETECTION

• Cisco claims that the key to their solution’s efficacy is data captured by its SenderBase® reputation service, dropping about 80% of the unwanted email. However, SenderBase is a 2nd generation reputation service that measures DNSBL and message volumes and performs no behavioral analysis. In fact, Cisco itself likens the SenderBase service to that of a “credit reporting service”, which we all know simply provides limited historical reputation rather than a detailed, content and contextual approach to assigning a behaviour score. The remaining messages are scanned using CASE (Context Adaptive Scanning Engine), their relatively new anti‐spam technology that was introduced in 2007. Cisco claims that CASE detects threats by analyzing four aspects of a message that together provide a spam score:

o Who sent the message and what do we know about this sender?
o Where does the call to action in the message take you?
o What is the nature of the message content?
o How was the message technically constructed?

• In reality, CASE is signature‐based, similar to AV, and accuracy depends on having the latest spam definitions; if the signatures are not up to date, the spam is not blocked.

FALSE POSITIVES

• Cisco Spam & Virus Blocker also has a low false positive rate, although SenderBase (a 2nd‐generation reputation system), is subject to higher false positives because it relies simply on measuring IP history and message volumes ‐ not content ‐ to determine reputation.

• In comparison, because WatchGuard ReputationAuthority uses next generation technology, it provides a more accurate reputation score and results in significantly less false positives.

VIRUS PROTECTION

• Cisco Spam & Virus Blocker relies on Sophos technology for their AV signatures. Sophos is a mid‐range technology, as evidenced by 3rd party stats. In comparison, WatchGuard uses Kaspersky, which typically does better in 3rd party independent studies. In the short term, WatchGuard will be introducing a new Kaspersky technology (SafeStream), which will provide even faster anti‐virus protection to further increase our leadership in this area.

• In competitive situations where Cisco is positioning XCS’s reliance on KAV for anti‐virus as a disadvantage (for example, in US accounts where they do not want Russian technology deployed), as an alternative, WatchGuard offers McAfee AV as an add‐on subscription (additional cost).