We've used Surfcontrol (up to v4.6) over here and I personally don't recommend it. The built in "Riskfilter" did just "ok" trapping around 65-75% of incoming spam (this was updated via FTP on a nightly basis on a scheduled routine). That left us to create our own rules which worked with some effectiveness but are very hard to maintain (keeping up with the spammers). Daily, I would spend from 1-4 hours analyzing messages that slipped the filters, adjusting the rulesets/keywords to compensate for the changes, testing the effectiveness of said changes, and general maintenance of the system. Even then, we were only trapping 90-95% and when you consider our daily traffic is VERY high, that meant that 1,000 plus messages were slipping the filters a day. Not to mention, that we had all kinds of problems with the filtering queues filling up & slow processing which resulted in mail delays (even on a brand new 3.0 GHZ/1GB RAM server). In the end, we went with a hosted solution....Postini. It was more important to our attorneys to have constant mail flow with as little spam as possible and SurfControl just wasn't providing that for us.
Postini isn't perfect by any means but the amount of spam that slips the filters is probably around or under 1% per day and many of those get through because the person doesn't have their filters at the correct levels for the type of spam their getting. They have a large law firm clientele (and some of the biggest at that) so that made us far more comfortable switching to them.
So, if you have a small organization, an on-site solution may be manageable for you but in my experience, the larger you are the more sense it makes to go hosted. As long as you can get a trial period on either one, you should be able to find what works for you.