UTM - does it add more to your security or consolidate your security?

At the risk of pissing off Hoff, I am going to agree with Richard Stiennon twice in a row.  First his article in SC Magazine last month read like a marketing piece for Cobia, now his most recent post in his Threat Chaos blog on ZDNet has some great points on UTM. Richards points that I agree with are:

1. UTM comes down to a best-of-breed versus suite decision.  Can a UTM really provide a best in class solution for each type of security application on board?  Hoff and the Crossbeam gang have built their business on that, but does it scale down from large corporations and carriers to the rest of the world?  Also, as Richard points to a point made by Barry Shteiman, can just OEM'ing or piling on applications without any integration or synergies be the effective long term?  I think first generation UTM's just piled up lots of security applications.  I think the market is going to demand integration and one plus one equals three value in the near future.

2. Does UTM add to security or consolidate security?  Richard points out that the Asian security market is immature enough that a UTM is actually bringing new security functionality to customers. In more mature markets, UTM just consolidates existing security apps in one box. I can see this, but I think I disagree a bit.  I think most people buy UTM for one or two security applications and get the rest "for free".  Many of them are almost throw ins.

3. Spam and content filtering are real drivers in the UTM market.  Too many of us seem to focus on the firewall, IDS and AV applications. Meanwhile spam and content filtering are very important to many UTM buyers.  This is a great lesson for us with Cobia.

4. Finally, Richard is still fighting the, is UTM for the biggest enterprises fight.  Hoff gets violent about this one and I am sure Richard in his own mid-western way gets down right feisty, but people still want to know.