Tumbleweed Releases Free FTP Audit Tool to Identify Rogue Servers and Unsecure Traffic; Tumbleweed FTP Analyzer(TM) Gives Enterprises Unique Visibility Into Their FTP Usage and Data Risk

The Tumbleweed FTP Analyzer is a Java-based network snifferapplication that allows organizations to capture and analyze securevs. unsecure file transfers and sessions taking place within anorganization. The new free tool helps organizations find the FTPservers that pose a security risk to the organization, generating atwo-page executive-level report as well as a detailed log. Theexecutive report identifies:

-- Overall volume of secure and unsecure file transfer traffic

-- Secure and unsecure file transfer traffic over time

-- Top 10 largest unsecured files transferred

-- Top 10 busiest FTP servers

"Regulatory compliance mandates, such as the Sarbanes-Oxley Actand the Health Insurance Portability and Accountability Act (HIPAA),require companies to document business processes," said L. FrankKenney, Research Director for Gartner. "One frequently overlookedprocess is data movement -- specifically data movement using the FileTransfer Protocol (FTP). FTP by itself does not provide mechanisms formanagement, monitoring, security or process control. Any device thatcan detect, monitor and analyze FTP usage can help organizationsidentify their unmanaged FTP -- an important first step in securingand managing file transmissions."

According to the Privacy Rights Clearinghouse, over 82 millionAmericans have had their personal identities put at risk by data lossincidents since February 2005. But companies are not required toreport loss which compromises company secrets, insider information orother corporate assets unrelated to personal identities. The use ofunmanaged FTP to share sensitive data continues to put organizationsat risk. Internet FTP usage is widespread, often insecure, and leavescompany data exposed and vulnerable. In many instances, organizationsare unaware of the FTP traffic taking place within their ITenvironments. Without a monitoring system in place, organizations haveno visibility into the volume and type of FTP traffic traversing theirnetworks. Over time, many organizations find that they have fosteredan environment with a large number of "rogue" FTP servers.

"Organizations are discovering that they are at significant riskfrom departmental FTP servers that are often deployed outside of IT bydifferent business units, in most cases for legitimate use but withlittle to no security in place," said John Thielens, CTO of TumbleweedCommunications. "The Tumbleweed FTP Analyzer helps identify theserogue FTP servers, and monitors the volume of unsecure traffic sent inand out of the organization."

The new FTP Analyzer delivers features including:

-- Monitoring of Port 21 FTP traffic to analyze the flow of secure and unsecure FTP traffic

-- Scheduling functionality allows users to create a 'set and forget it' schedule of monitoring

-- Reporting and analysis provide users with easy-to-read, non-technical executive level reports

-- 30-day license provides users with ample time to analyze their network traffic

The free Tumbleweed FTP Analyzer is downloadable and can be foundat: http://www.tumbleweed.com/products/securetransport/ftpanalyzer/

Safe Harbor Statement

Tumbleweed cautions that forward-looking statements contained inthis press release are based on current plans and expectations as ofthe date of this press release, and that a number of factors couldcause the actual results to differ materially from the guidance givenat this time. These factors are described in the Safe Harbor statementbelow.

Except for the historical information contained herein, thematters discussed in this press release may constitute forward-lookingstatements that involve risks and uncertainties that could causeactual results to differ materially from those projected, particularlywith respect to the functionality and performance of Tumbleweed'sproducts. In some cases, forward-looking statements can be identifiedby terminology such as "may," "will," "should," "potential,""continue," "expects," "anticipates," "intends," "plans," "believes,""estimates," and similar expressions. For further cautions about therisks of investing in Tumbleweed, we refer you to the documentsTumbleweed files from time to time with the Securities and ExchangeCommission, particularly Tumbleweed's Form 10-K filed March 16, 2006and Form 10-Q filed May 10, 2006.

Tumbleweed assumes no obligation to update information containedin this press release. Although this release may remain available onTumbleweed's website or elsewhere, its continued availability does notindicate that Tumbleweed is reaffirming or confirming any of theinformation contained herein.

About Tumbleweed Communications Corp.

Tumbleweed provides security solutions for email protection, filetransfers, and identity validation that allow organizations to safelyconduct business over the Internet. Tumbleweed offers these solutionsin three comprehensive product suites: MailGate(R),SecureTransport(TM), and Validation Authority(TM). MailGate providesprotection against spam, viruses, and attacks, and enablespolicy-based message filtering, encryption, and routing.SecureTransport enables business to safely exchange large files andtransactions without proprietary software. Validation Authority is theworld-leading solution for determining the validity of digitalcertificates. Tumbleweed's enterprise and government customers includeABN Amro, Bank of America Securities, Catholic Healthcare West, JPMorgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St.Luke's Episcopal Healthcare System, the U.S. Food and DrugAdministration, the U.S. Department of Defense, and all four branchesof the U.S. Armed Forces. Tumbleweed was founded in 1993 and isheadquartered in Redwood City, Calif. For additional information aboutTumbleweed go to www.tumbleweed.com or call 650-216-2000.

Tumbleweed, the Arrows logo, MailGate, SecureTransport andValidation Authority are either registered trademarks or trademarks ofTumbleweed Communications Corp. in the United States and/or othercountries. All other trademarks are the property of their respectiveowners.