Matt, my recommendation is to start with the default settings of 90 for spam positive and 50 for suspected spam.
The spam threshold of 90 is calibrated to have a comparable false-positive rate to Brightmail, so most customers using IronPort Anti-Spam today are comfortable just dropping messages with a score > 90.
The suspected spam threshold is slightly more aggressive than Brightmail, so I would recommend keeping it at 50 but taking a more benign action on the messages like tagging the subject & delivering. If you want to be on the safe side, you can also start testing with a suspected spam threshold of 75.
