Why would a user choose an on-premises ESA versus the CES solution?

An on-premises Email Security Appliance (ESA) is chosen when an organization has stringent data sovereignty requirements, compliance regulations, or internal policies that mandate all sensitive email data and its processing must reside within the organization's physical control and data center, rather than a third-party cloud.

Unpredictable demand is typically a reason to choose cloud solutions like CES, as they offer elastic scalability to handle fluctuating loads more efficiently than fixed on-premises hardware.

If a server team wants to outsource a service, they would typically opt for a cloud-based solution like CES, as it offloads the operational and management responsibilities to a service provider.

Both on-premises ESA and cloud-based CES solutions can logically operate 'inline' by being the MX record destination, so this is not a distinguishing factor for choosing between them based on deployment type.