In my personal opinion, I would personally allow to a point "Instant Messaging Service". I'm sure most of you know by now, that Microsoft Windows XP allows remote access to the system with a Personal Instant Message invite, and this allows me to reconfigure clients and family computers without leaving my desk. However, with the "mentality" of individuals that download everything. The virus scans do not work hand and hand like they do with mail and website script checking. I personally allow them in my shop "which is a privately owned company" However, when I'm out consulting. I frown upon them every way possible, so you have to take in consideration what you want to accomplish. If you allow them, will they decrease productivity. If you allow them, can information leaks increase. If you allow them, are you prepared for the chance of increase virus incidents. Then there is the actual vulnerabilities... a lot to consider...