You may have missed TechEd last week in the US. I did due presenting at the Technical Roadshow, but something rather significant caught my eye just now from an internal email, which I wasn't aware of before. Gordon Mangione in his security keynote mentioned a filter available later this year which would recognise traffic from Microsoft Update and would cache the content so only the first user would take the hit of the download time.
This is a really powerful feature. To elaborate slightly... ISA's upcoming ability will be to cache the traffic for Windows Update, Microsoft Update and SUS/WSUS. This is achieved by the addition of the ability to cache BITS traffic over HTTP. It is expected that this BITS cache filter will be delivered for free (probably from a feature pack) through microsoft.com.
The net result of this is that the ISA can cache:
Those of you out there with remote sites linked via low bandwidth WAN links no longer may need to place remote WSUS and SMS servers just to cache the updates locally. The ISA server will be do it for you. Exciting times ahead.