Greg Young

Guest blog by Peter Firstbrook

While doing the research for our forthcoming secure email gateway Magic Quadrant, we are very disappointed with how few anti-spam solutions have reports that show the false positive (legit email tagged as spam) and false negative (spam that get to the inbox) rates.  While there is no perfect way to measure spam accuracy exactly there are good proxies that can be easily measured; false positives can be represented by the emails that were released from quarantines, and false negatives are messages that make it into the inbox that users reported as spam.  (And while we are at it, shame on any anti-spam solution that does not even offer an email client “is Spam” button.) Do anti-spam solutions have something to hide?  Most brag about their “honeypot” catch rates but “honeypots” rarely get legitimate email.

Although Gartner customers almost never complain about false positive rates, I wonder if false positives are under estimated. End users rarely complain about false positives, but they are very vocal reporting Spam in their inbox. Box Sentry (www.boxsentry.com) recently did a tests in a number of organizations and found the false positive rate in some organizations using popular ant-spam tools was as high as 13% of legitimate emails. The largest proportion of false positives in their study was legitimate person-to-person traffic.  While it could be that these organizations have over-tuned their systems to block more Spam at the expense of quarantining more legit email, the reality was the email administrators had no idea they had such a high false positive rate because they never checked. Have you?  Organizations that do not send daily digests to end users should check their quarantine to ensure that it is not a tar pit of business critical communications.   Let us know what you find.

Peter Firstbrook| Research Director| Gartner
Malware and antispam

2 Comments »

Category: Uncategorized     Tags:

Share