Security experts will tell you that it isn't always about technology. While the latest tools help, more often than not security comes down to policy and staff education. If you can get employees to commit policy to memory and understand how threats may target or involve them, you've gone a long way toward locking down the organization.

But here's the rub: Policy puts folks to sleep, and security training isn't much more enthralling. So even if employees have no evil intent, they still may put the company at risk by forwarding information that violates policy or regulatory requirements.

This so-called data leakage problem has given rise to a number of new technology tools, but those from Orchestria also address the policy/training issue.

Orchestria started out on the regulatory compliance side of the messaging business with a tool financial firms could use to ensure all outbound e-mail contained disclaimers required by law. And it has evolved as regulatory, security and corporate governance issues have blossomed.

In a nutshell, the company's tools bolt onto messaging systems and examine all messages - e-mail, instant messages, blogs - for policy compliance before they are sent/posted. Scans generate risk scores by looking at everything from file size to the presence and proximity of certain words and context derived by considering who the sender is (title and department) and who the message is intended for, says Michael Rothschild, senior director of product marketing.

"We analyze the message and, if something violates policy, present a pop-up that says, 'It looks like you're trying to send 10 Social Security numbers to an unauthorized user. Are you sure you want to do that?'" Rothschild says.

Alternatively, the tool can be configured to automatically block egregious violations - such as distributed financial data - or silently monitor and report activity, perhaps someone sending out their resume.

All violations are centrally tracked by the management server, which also is responsible for distributing policies to agents that run on messaging servers and endpoints.

A core benefit of Orchestria's approach: "If the message was never sent, it didn't happen," Rothschild says. "It is not in your archive and can't be discovered later."