We opted for an on-site appliance (a Linux server really, a VM in our case, but it's just a web-based console as far as configuration goes). Their cloud version is the same product running on their servers and that would relieve you of the work we put in, as I'll describe, but we wouldn't have it any other way. The on-prem version is what we like the most about this "software."
We have another VM running at an alternate site, they sync with each other and one can take over if the other is down or unreachable. They also can load-balance. Yes, this solution is a little more complex than our previous solution. But it's in the complexity that you get the flexibility.
SpamTitan support has helped us tweak the settings based on what we're seeing in the console. SpamTitan has an excellent history report that shows everything, or you can filter very easily. Unfiltered you can see blocked (and why), quarantined, accepted...everything. If you don't see it, that email did not get to you, and in our experience, it has been a Sender issue every time.
SpamTitan, with the clustered configuration, is less than half the cost of our old solution and we never have to upgrade or replace the "appliance" because it's just a VM, or one of our physical servers, either way, you never face an End of Life "you must upgrade" mandate from SpamTitan. Also - these servers will spool email until they can reach the email server. So if your email server is down or unreachable, you most likely are still getting emails.
Spam filtering was costing us a lot of money, and then the vendor said we had to replace their appliance with a new one (about $3000 just for the appliance). SpamTitan costs much less per year, and we'll never have to replace an appliance again. We got SpamTitan's clustered solution, so we have a second VM running at our DR site, the two sync (or re-sync if there has been an outage), giving us load-balancing and fault-tolerance, and at a still significant saving.
