What a mess! Users are not doing what we want them to do.
One of the most important facts in current IT strategies is centralization of everything. Why are almost all IT guys supporting centralized infrastructures and establish policies, that restrict users throughout the organisation in using internet access, even if it's incredibly slow and annoying for them?

The answer is as simple as obvious: IT security guys do not work in subsidiaries.

For years they resisted to be user-friendly, to improve user-experience in the remote locations, because they had no lobby.

But even the weakest succeed some times, if they are brave and faithful and plead their case consistently.

The pressure of remote users to get better web access increased of course because of their private experience as well. xDSL and cable uplinks with 5-10 MBit make a big difference to 300ms delay times via the central proxy of the HQ.

The answer to all that is establishing a multilayer approach to statisfy the needs of users and security experts as well. Having fully fledged web filters in any location, complemented by Purewire web security as a service on mobile notebooks and some dedicated HQ webfilters as well.

No additional management overhead, manageable costs and happy users!

And by the way, the NG firewall features delegated scanning. The small branch office box will scan large DVDs as well, because it delegates the task to the large proxy in the datacenter. Smart!