As GigaOM reported, Google announced the $625M acquisition of Postini this morning, which was not unforeseen. With Cisco’s $800M acquisition of Ironport (which was hardware-based), Symantec’s $300M acquisition of Brightmail (which channeled its services thru MessageLabs) and Microsoft’s acquisition of FrontBridge (which was service-based) there were only a view acquisition targets remaining in the email security marketplace: MXLogic, Postini, and UK-based MessageLabs.

These prices make Sophos’ acquisition of Vancouver’s Activestate (which, among its products, marketed an interesting anti-spam software solution) for $26M look like a bargain. And with all of these transactions coming in the multiple hundreds of millions of dollars, the number of sellers probably now exceeds the buyers by a 2:1 margin. That means that the remaining two will need to get down to the business of making money.

Fortunately that’s not actually very difficult in the email border security marketplace. The value of anti-spam/anti-virus services for email may soon exceed the money spent on providing email itself. Although the market tracks behind analyst estimates (don’t they all?) email border security was a $3.5Bn market in 2006 and will top $6Bn in 2010, according to Radicati.

The email services business is capital and operationally intensive, and requires a fairly large investment to develop a business. Postini has gone through about $34M in 4 or 5 rounds since its first financing in 2000, from VCs including AltoTech Ventures, LLC; August Capital; Mobius Venture Capital; Pacifica Fund; Summit Accelerator Fund; Sun Microsystems Venture & Strategic Investments; and Bessemer Venture Partners. The company’s probably been cash-flow positive (or near to it) since late 2005.

It’s tempting to view this acquisition as an admission that fighting spam is a problem requiring dedicated resources.. the upshot would be that GoOgle will certainly be able to increase the efficacy of their internal spam-fighting strategies. But that ain’t the whole story. Google likely does have the expertise to effectively eradicate spam flowing into their G:Mail network, but of course it could also benefit from more advanced strategies developed by a more evolved spam fighter, for sure. But that’s not worth $625M.

More ominously for Microsofties, Postini’s customer list (which likely numbers into the tens of millions of mailboxes) makes an excellent channel-to-market for a business-class managed email service as G:Mail moves into that particular high-value market segment. While Postini’s mailbox numbers are inflated because of some of their early success with ISPs (FrontBridge was totally focused on Enterprise), each of the “big four” managed email security vendors did a fairly good job at optimizing their sales and customer acquisition processes for dealing with business customers. Google has no experience with this at all.

But wait, there’s more: most people make the mistake of looking at the “big four” (Postini, FrontBridge, MXLogic, MessageLabs) as purely anti-spam/anti-virus companies. And fair enough: that was the crux of their value proposition as the spam problem flowered out of the late nineties and hit home hard starting around 2001.

But the big undercurrent in the managed email services marketplace after the anti-spam value proposition started to blow over in 2005 actually became compliance archiving. Big companies were spurred by the penalties imposed on company directors and board members by Sarbanes-Oxley combined with the NASD 3010 and SEC 17a requirements for public companies. Also, an increasing number of court cases have relied on email discovery to substantiate their cases, which if your archives are on CDs or Tapes can be very, very costly. That’s why FrontBridge purchased MessageRite in 2004, and it’s why immediately thereafter their competitors set forth beefing up their email archiving and retrieval stories. Google hints at this in their acquisition FAQ:

” .. businesses have been forced to choose between innovation on one hand, and these backoffice mandates on the other. In effect, many businesses use legacy systems not because they are the best for their users, but because they are able to support complex business rules.”

They made an even stronger statement to this effect on the conference call. As El Reg reported:

“In a conference call, Girouard added without giving figures that there had been “significant interest” from large business about Google Apps but that complex security requirements and meeting regulatory compliance have acted as a barrier. “Up to date we have focused on partnerships to resolve these issue but we recognised it’s in our own interest to pull things together” by buying a technology that can boost its hosted apps business.”

The archiving and electronic discovery driver in particular plays well into GoOG’s current capabilities — massively-scaled indexing, searching, and storage of data — particularly well, don’t ya think?