The effect on the business can be much, much greater than a virus.

At the end of the day, the IT administrator does not care if it is spam or a virus. All they care is there is bad stuff coming off the Internet... and they want one vendor to protect them.