New Report Outlines Critical Success Factors for Effective Email Content Management

White Paper Compares Secure Messaging Best Practices with Tumbleweed's Policy-Driven Architecture

Redwood City, CA - November 18, 2002 - Tumbleweed® Communications Corp.(Nasdaq:TMWD - News), a leading provider of secure messaging applications for businesses and government agencies using the Internet, today announced the findings of a jointly-sponsored white paper completed by IDC. The paper, entitled, "Message Content Management: Corporations' Rapidly Expanding Means to Control Message Activity"(published in November 2002), examines how leading organizations are addressing email message management and implementing means to control their enterprise message content. Authored by IDC analysts Brian Burke, John Daly and Roseann Day, the white paper also identifies planning, deployment and administration best practices, as well as attributes of an effective technology solution. The research group developed these guidelines after conducting in-depth interviews with IT executives at companies in the financial services, software services, insurance and manufacturing industry sectors.

"As email becomes increasingly pervasive to businesses, the challenges associated with extending enterprise communications to partners and customers has increased in scope and complexity,"said Brian Burke, Senior Analyst at IDC. "While we found that many enterprises have developed up-to-date means to protect against external email threats, far fewer have properly addressed other factors, for example unsolicited email (Spam), the legitimate internal threat associated with employee access to digital intellectual property, and protection of customer-sensitive information. These companies should look to deploy a transparent, content-focused message management solution, such as the Tumbleweed Secure Guardian family of products, to facilitate the development and enforcement of granular business policies."

IDC identified four critical success factors enterprise organizations must address to ensure effective message content management. Those key factors are:

• Iterative implementation - An incremental, enterprise-tailored approach to building secure messaging policies that limits the number of "false-positives" the system returns for messages containing Spam, private customer data, intellectual property, etc.



• Comprehensive but precise content management - The ability of a secure messaging solution to scan inbound and outbound email traffic and properly identify all violations of content policy (e.g. regulation violations, inappropriate content, harassment, etc.)



• Audit trails for email communications - The ability to selectively archive messages based on content or sender/recipient identity, in order to enable forensic or investigative analysis of enterprise email traffic.



• Transparent security - The need to centralize development and management of secure messaging policies at the administrator level, taking the burden away from end users.

In order for businesses to minimize the liabilities associated with email and instead capitalize on email's value, IDC has concluded that the development and enforcement of company developed messaging policies is required,"said Jeff Smith, Chief Executive Officer of Tumbleweed Communications. "The Tumbleweed Secure Guardian family of products have been developed to satisfy these business requirements, enabling businesses to protect valuable intellectual property and prevent customer-sensitive information from leaving the network unencrypted, while keeping Spam and other inappropriate message traffic off corporate networks. We were encouraged to see IDC's user-based research validate our product direction."

To download a copy of the white paper, please visit: http://www.tumbleweed.com

About Tumbleweed
Tumbleweed is a leading provider of secure messaging applications for businesses using the Internet. Tumbleweed's robust policy-based framework empowers organizations to safely share and protect critical information, increase customer loyalty and privacy and dramatically reduce costs. Tumbleweed is trusted by hundreds of blue-chip customers including American Express, Amgen Inc., Bank of America Securities, Catholic Healthcare West, ChevronTexaco Corp., Dell Computer Corporation, National City Corporation, Oppenheimer Funds, Inc., The Regence Group (Blue Cross/Blue Shield), TD Waterhouse Investor Services, Inc., the U.S. Department of Energy and the U.S. Navy. Tumbleweed Communications was founded in 1993 and is headquartered in Redwood City, California.

Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations, and that a number of factors could cause the actual results to differ materially from the forward-looking statements made at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to Tumbleweed's products, the timing of new releases, and developments in the secure messaging industry. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 30, 2002 and Form 10-Q filed November 14, 2002. Tumbleweed assumes no obligation to update information contained in this press release.