The utility's antivirus profile on the corporate billing segment is fully configured and applied to the policy, yet malware embedded inside an HTTPS download from an external site is not being detected. Investigation shows the policy's SSL/SSH inspection profile is set to certificate inspection. What is the most likely explanation for the missed detection?
Select an answer to reveal the explanation.
Short Explanation
Antivirus can only judge what it can actually read, and certificate inspection never unlocks the payload for it to read. The session stays encrypted end to end under that setting, so whatever malware is riding inside an HTTPS download simply never reaches the scanning engine. Swapping to deep inspection is what exposes that content in the first place.
Full Explanation
Certificate inspection only examines the TLS handshake's metadata — the SNI and certificate details — and deliberately leaves the session encrypted all the way through, which means the antivirus engine never receives decrypted content to scan for HTTPS traffic under that setting, regardless of how correctly the antivirus profile itself is configured. This is a common gap: administrators sometimes assume an applied antivirus profile automatically covers encrypted traffic, when in fact payload visibility depends entirely on the SSL inspection mode, and only deep inspection decrypts the session enough to expose file content to that engine. An outdated signature database could certainly cause a missed detection in general, but it wouldn't explain a total lack of visibility specifically tied to HTTPS traffic while the SSL profile is set to certificate inspection — the pattern points to a visibility gap, not a stale-signature gap. Switching between flow-based and proxy-based inspection mode changes how antivirus scanning is architected but does not by itself expose encrypted payload content; that visibility question is answered by the SSL inspection setting, not the flow/proxy choice. Antivirus profiles absolutely can be applied alongside any SSL/SSH inspection profile, including certificate inspection — they simply won't have anything decrypted to act on for HTTPS traffic in that case. The fix to verify is switching the relevant policy's SSL/SSH inspection profile to deep inspection and re-testing with a benign EICAR-style file over HTTPS to confirm detection now occurs.