Lots of flexibility, handy real-time performance monitor.
Needlessly complicated install process.
Not bad at all, with some useful tricks to deal with an outbreak.
Aladdin's eSafe did well enough and has some features that would be particularly useful during an outbreak, but performance was nothing special. Although eSafe is up to version 4 now, that version is purely appliance-oriented. The last version to support Exchange was 3.5, which the company still sells and supports (for now) despite its focus on moving away from that side of the business towards its Linux-based appliance version.
Installation was challenging, and involved some unnecessary pretension: because the software is intended as a gateway product, you must tick a "this machine is dedicated to eSafe mail" box and the company states that it will not provide support if other software is installed. So much for content filtering or anti-spam, then, although the product does offer limited capabilities in these areas too.
Installation requires manual creation and configuration of a quarantine mailbox, which proved strangely troublesome, and once running, the software took a while to register its own Exchange component, so the configuration tool at first complained there was nothing to manage. Once it's actually running, the software offers an excellent interface with lots of granularity, particularly in how and where to report incidents via email, logs, system events, and so on.
The test ran in average times: 50 minutes to queue mail and then nearly 110 to process it. However, the scanner had only detected 2,900 viruses by then, making it only fractionally more efficient than the worst scoring product.
The quarantine log interface is very slow: all the fields are updated in real-time and with 10,000 records to process that can take a while. You can export it to a text file, which comes out in a strange semicolon-delimited format, but easily processed nonetheless.
Clean messages were reported oddly: of the 104 timestamps, 76 were listed as "clean (scanned)" and 28 as "allowed (not scanned)". It is questionable why the distinction should be drawn, since the messages were identical.