Enterprise Solutions

Hybrid On-Premise and Off-Premise Protection

Multiple Engine Protection

Forefront Security for Exchange Server is unique in that it incorporates multiple antivirus engines from industry-leading security partners and manages them in a single solution.  All updates for all engine partners are carefully tested by Microsoft before they are provided to customers via automated, secure updating.  By using multiple scan engines, Forefront Security for Exchange Server delivers several critical advantages:

• It increases the chances that emerging threats will be quickly caught.

• It provides redundancy to help protect against scan failures or defects in individual engines; if an engine fails, other engines continue scanning messages.

• It gives administrators an effective way to choose the most appropriate level of protection for their environment given their security needs and server performance capabilities.

• It allows engines to be taken offline for updates or reconfiguration without forcing messages to be queued.

AV-Test.org signature file response times

Click image to see larger view

 

AVTest.org monitored lab response times for 61 "in the wild" viruses and variants that appeared between October and December 2007.  For the 26 viruses that showed significant variations in detection times, Forefront server security engine sets performed much better than the three leading competitive solutions—even taking into account the beta engine release from these vendors.  Because Forefront Security for Exchange Server combines the detection abilities of multiple engines, the odds that a virus will go unblocked or undetected for long periods are greatly reduced. Organizations benefit from all updates for the set of engines used, not just from updates to a single engine.

The additional protection offered by multiple engines comes at a small performance cost. Benchmark tests performed by 3Sharp, LLC in October 2006 using Forefront Security for Exchange Server found that increasing the number of scan engines assigned to a transport scan job added between 1% and 4% to CPU loads per engine—meaning that using a 5-engine scan can add as little as 5% to the transport server’s CPU usage. For more information on using Forefront Security for Exchange Server to provide multiple engine protection for enterprise messaging environments, see our white paper.