ESA blocks sender with bad sender IP reputation (ESA creates query for every connection).
WSA blocks web transactions based on bad IP reputation of the web server (WSA receives databases updates periodialy - on evrey 3-5 minutes if I'm not mistaken).
All information is gathered from Cisco SIO: http://www.senderbase.org/