Proofpoint has become the latest messaging security company to offer its technology as a hosted service.

The company said Proofpoint on Demand offers enterprises the same anti-spam, anti-virus and email policy enforcement, and outbound-content monitoring as its appliance and software, but without the headache of in-house management.

The company says it will distinguish itself in the already large market - currently including Postini (being acquired by Google), Microsoft, Symantec, Trend Micro, McAfee, MessageLabs, and several others - by offering more flexible configurations. Customers will be able to mix and match components, the company said.

Traditionally, hosted email security services have appealed more to small and mid-size businesses, which don't have the IT staff to manage an appliance or software in-house. That's beginning to change, says Michael Osterman, president of Osterman Research.

"Some [enterprises] are finding it cheaper to use a hosted service; you get a lot more flexibility and you're not as locked into the vendor," Osterman said. In addition, many large companies are seeking a hybrid approach where they could, for example, run an appliance at headquarters, where the bulk of the IT staff is, but deploy hosted services in smaller offices, he said.

This is why many messaging-security vendors now are offering their products as software, appliances or hosted services, as they attempt to cater to all-comers. Proofpoint also sells a virtual version of its appliance; that is another trend in the messaging-security market.

The anti-spam features in Proofpoint's new service come from the company's MLX technology, which uses reputation services and content filters to block spam, image spam and phishing attacks. For virus protection, customers can chose from F-Secure or McAfee technology, while Proofpoint's own Zero-Hour Antivirus module blocks threats in the very early stages before signatures have been released, the company said.

According to the company, Proofpoint on Demand's Content Compliance module helps administrators define and enforce acceptable use policies about file type, message size and message content for inbound and outbound messages.

The Data Leak Prevention module prevents sensitive information from leaving an organisation without authorisation, and the Regulatory Compliance module uses dictionaries and smart identifiers to flag sensitive content and protect data covered by federal or industry regulations or corporate policies.

Going one step further, the Digital Asset Security module uses machine-learning technology to analyse and classify sensitive information, then monitors outbound messages for that data, company officials said.

All modules are administered with Proofpoint's web-based interface that offers a unified policy framework, generates customised reports and feeds status information.

Proofpoint on Demand is available and is priced per user, per year, depending on which modules a customer chooses. For example, a company with 1,000 users that chooses spam and virus protection and the Content Compliance module would pay $20,000 a year.