Tumbleweed advances the war on spam with new adaptive image filtering technology

Company's new AIF technology attacks image spam, the latest covert spamming technique to bypass existing email security filters

Redwood City, CA – Nov. 7, 2006 – Tumbleweed® Communications Corp. (NASDAQ:TMWD), providers of innovative messaging security solutions, today introduced its Adaptive Image Filtering (AIF) technology, specifically designed to combat the ever-increasing amount of image spam. In recent tests, Tumbleweed's Message Protection Lab has found as much as 36 percent of all spam was image-based. Yet, it is not consistently blocked using yesterday's signature and reputation-based technologies.

“Spammers are relentless at adapting their methods to circumvent existing spam filters. The latest trick has been to use images instead of text and randomize graphics to avoid signature detection,” said Dr. Taher Elgamal, Chief Technology Officer at Tumbleweed. “To keep up with their changing tactics, vendors must adapt and create new ways to block this time and resource draining nuisance.”

Existing email security technologies such as reputation filters that purport to stop image spam have not been effective. Adapting their tactics, spammers have hijacked legitimate computers to evade reputation filters or randomized image spam graphics with dots, changing sizes, varying colors, and multiple animated graphics. These techniques enable spam to slip past current filters, creating an enormous new wave of spam and malicious messages.

Tumbleweed's new AIF technology analyzes email images using an image-processing technique called a wavelet transform. This technique reduces the image to a mathematical formula that represents the structure of the image, but allows for variation, a technique known as “fuzzy matching.” This image processing takes into account the image-randomizing practices that spammers rely on to circumvent email filters. This approach to identifying image spam can be likened to how the human eye quickly perceives similarities in images, while the exact size, colors, and proportions may vary.

When a new image spam is filtered by Tumbleweed's MailGate appliance, it goes through the same mathematical process, and the signature of the wavelet transform is compared to existing image spam signatures, blocking spam with similar but slightly varying graphics.

“Image based spam is difficult to detect if you are relying on traditional products that have basic email security functions,” said Brian Burke, research manager at IDC. “As spam continues to become more complex, organizations will need to implement adaptive email security solutions that protect against a variety of threats that spammers use to bypass existing technologies.”

Tumbleweed's Message Protection Lab™ has analyzed thousands of messages and continues to build its database of image-spam for pattern matching. In addition to AIF, Tumbleweed's Recurrent Pattern Detection (RPD)™ system spots outbreaks of new image spam coming from multiple sources around the world. Together, these two techniques provide an effective defense against new spam methods while maintaining high levels of accuracy.

About the Tumbleweed MailGate Product Suite
The Tumbleweed MailGate® Product Suite is a family of products for protecting, filtering and monitoring corporate email. These best-in-breed products enable businesses to manage inbound and outbound traffic, block threats, encrypt messages and optimize network performance. MailGate products include MailGate Appliance™, MailGate Email Firewall™ software and MailGate Secure Messenger™ software, each optimized for specific environments and security challenges.

• MailGate Appliance: A powerful and easy-to-deploy hardened Linux appliance, providing integrated network edge defense, anti-spam, anti-virus, content filtering, policy management, and outbound encryption.
• MailGate Email Firewall: A comprehensive email security software offering, with functionality ranging from inbound threat prevention to outbound content filtering, monitoring and encryption.
• MailGate Secure Messenger: A policy-based, secure message delivery solution that inspects incoming and outgoing mail and dynamically applies user-defined encryption and routing preferences.

SAFE HARBOR STATEMENT
Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations as of the date of this press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the functionality and performance of Tumbleweed’s adaptive image filtering technology.  In some cases, forward-looking statements can be identified by terminology such as “may,” “will,” “should,” “potential,” “continue,” “expects,” “anticipates,” “intends,” “plans,” “believes,” “estimates,” and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed’s Form 10-K filed March 16, 2006 and Form 10-Q filed August 8, 2006.

Tumbleweed assumes no obligation to update information contained in this press release. Although this release may remain available on Tumbleweed’s website or elsewhere, its continued availability does not indicate that Tumbleweed is reaffirming or confirming any of the information contained herein.

About Tumbleweed
Tumbleweed provides world-class innovative messaging security solutions for organizations of all sizes.  Organizations rely on Tumbleweed's solutions to securely manage their Internet communications, spanning email management to file transfers. Tumbleweed has more than 2,300 customers worldwide, representing industries in Finance, Healthcare, and the U.S. Government. The world’s most security conscious organizations rely upon Tumbleweed technology including Bank of America Securities, JP Morgan Chase & Co., the U.S. Food and Drug Administration, and the U.S. Department of Defense. Our award-winning products build on thirteen years of R&D and 25 security patents in the U.S. alone – many of which are licensed by other security vendors, http://www.tumbleweed.com/company/patents/patent_licenses.html. For more information, visit www.tumbleweed.com.

Tumbleweed, the Arrows logo, MailGate, MailGate Appliance, MailGate Email Firewall, MailGate Secure Messenger, SecureTransport and Validation Authority are either registered trademarks or trademarks of Tumbleweed Communications Corp. in the United States and/or other countries. All other trademarks are the property of their respective owners.

###