We opted for an on-site appliance (a Linux server really, a VM in our case, but it's just a web-based console as far as configuration goes). Their cloud version is the same product running on their servers and that would relieve you of the work we put in, as I'll describe, but we wouldn't have it any other way.
The on-prem version is what we like the most about this "software." We have another VM running at an alternate site, they sync with each other and one can take over if the other is down or unreachable. They also can load-balance.
Yes this solution is a little more complex than are previous solution. But it's in the complexity that you get the flexibility. SpamTitan support has helped us tweak the settings based on what we're seeing in the console. Excellent history report shows everything, or you can filter very easily. Unfiltered you can see blocked (and why), quarantined, accepted...everything. If you don't see it, that email did not get to you, and in our experience it has been a Sender issue every time.
SpamTitan, with the clustered configuration is less that half the cost of our old solution and we never have to upgrade or replace the "appliance" because it's just a VM, or one of our physical servers, either way, you never face an End of Life "you must upgrade" mandate from SpamTitan.
Also - these servers will spool email until they can reach the email server. So if your email server is down or unreachable, you most likely are still getting email.
Well...it does require us to do some of the lifting and I have discovered there was a lot I didn't know about fighting spam. I turned on one block setting and started blocking emails I didn't want to block, okay...turn that off!
We had warned all of our employees that we were switching products and to be on the lookout for spam and/or missing emails. Most reports were false, but in some cases there was a problem with the settings and this helped us to tweak the product. Also be aware that you need to use a trusted IP address or your emails may end up in the recipient's spam folder. We just used the IP from our old solution once we ran into this issue.
There are certainly other examples, things not working right because we didn't set it up just right (we tend to do things on our own, we learn more that way). Every time we've gotten stuck I have gone to the website and checked their knowledge base. If I didn't find the answer I create a ticket. If you give them a console-generated code they can get into your system and look at your settings.
After a month or two I think we have the settings where we want them. However, we keep an eye on the history report, watching for any signs of trouble. The product worked well right out of the box, but now it's really doing a good job, without blocking good emails (yes, some bad emails get through, but it's at least as good as our old expensive managed solution).