I was at a security seminar last week, one of the guys on the
panel was from Trend, had some interesting stuff to say about
what software layer they scan at. Of course, the other vendors
are working on the same stuff - scan and detect at the
networking layer rather than the apps layer, but if Sophos
don't improve their offering substantially by next licence
renewal time (about 18 months), I'll likely look at moving one
of our site licences to Trend (subject to the usual evaulation
process of leading vendors of course). Think it's almost
certain we'll keep the McAfee licence: recent versions are so
much better than the old stuff, and they're moving into network
layer level scanning already too.