You bring up an excellent point with the malicious code subject. That is probably the main reason to filter right now. Look at all sites for dangerous code rather than just looking at the URL from an AUP point of view. The malicious code risk is way low on the radar of schools in my experience. Many of the filters they use are not equipped to deal effectively with that risk. What I said was mainly targeted at schools (my main customers) that rely on their filter to do something that monitoring can do better in my experience. It’s mainly psychological: a video camera that lets you know you are being watched vs a fence that needs to be jumped over.

About the palo alto thing…that is totally based on hearsay from all three companies and totally qualitative based on my experience. I could be totally wrong. Fine, I’ll go do some homework and find out the right answer.

I’m wondering about your last paragraph.

What if you’re not just interested in “accountability” but also protecting against malicious drive-by client-side attacks?

Monitoring is important, but how do you reconcile AUP violations against legitimate sites doing illegitimate things if compromised?

Were you suggesting that monitoring can replace filtering?

Also, how did you establish that Palo Alto does MITM/SSL proxy the fastest?

Thanks,

Hoff