Anti-spam systems typically rely on a handful of techniques, but do not for example work with anti-web phishing packages, for example anything containing a link that resolves to a specific IP known to belong to a bullet proof hosting company in China which is probably spam makes it through instead, or a user that never recieves gif or jpg images legitimately starts recieving hundreds of stock touting spams using images.

I think we need to start thinking about a standard language/descriptors for security events so that devices can share intelligence and behavior, i.e. if IP X tries to spam you do you block it, or based on the fact that it belongs to a domain that users send legitimate email to (i.e. aol.com) do you allow it anyways but try to block the spam based on other identifiers? If a host nmap scans your network do you look at blocking that entire subnet, or do you actually have legitimate use coming from or going to that network? All these things are impossible since there is no way for devices to share information sadly.

Much like warfare attackers typically evolve much faster than defenders, guerilla warfare vs. a traditional set piece battle, cavalry vs. long bows, or machine guns, insurgents and IEDs vs. convoys and civilian contractors. It doesn’t work to well in warfare and it certainly won’t work for computer and information security.