So when AMD's e-mail firewall vendor announced an antispam product in May, the decision to use it was more or less a no-brainer, says Smith. AMD already used Tumbleweed both to scan all incoming e-mail for viruses and to prevent confidential competitive information from leaving the company. With the Tumbleweed infrastructure already in place, AMD could plug in the vendor's new spam component for an annual per-user cost of about $5, an investment that paid for itself in less than a month. Today, 90 percent to 95 percent of all incoming spam is tagged as such. And no more than a quarter of a single IT employee's time is needed for ongoing maintenance.

"Having a combination of rules, heuristics and blacklists is really key because of the creativity of spammers," says Smith. "Simple, obvious solutions don't work today. We quickly realized that stopping junk mail is not a core competency of our company. And we needed to get out of that business as soon as we could."

In attacking AMD's spam problem, the last thing Smith wanted to do was to take on the role of corporate censor. "We didn't want to be perceived as content filterers," he says. In the interest of providing a nonhostile work environment, however, AMD does delete all spam with a high probability of containing adult content. But all other spammy mail gets sent along to users, marked as suspected spam. Users then decide for themselves whether to have Outlook filter all spam, put it in a spam folder, or keep it in their inboxes for manual scanning and deletion.

Now that spam is under control at AMD, Smith and his department attained the same herolike status Kesner enjoys. "It's a huge value IT has delivered to the company, and it's been huge, positive publicity for IT," he says.

Act Now, Think Long-Term

Like Smith at AMD, many CIOs would prefer to turn to the same vendor for all of their e-mail security services, including spam filtering, virus protection and denial-of-service protection. "You don't want a box for virus, a box for spam, a box for content filtering, a box for something else," agrees Maurene Caplan Grey, a research director at Gartner. "You want as few boxes as possible, and you want them to work nicely together with a central console for monitoring."