Security Profiles and Content Inspection
Inspection mode decides what is possible
FortiOS has two inspection engines. Flow-based inspection is the default: single-pass, accelerated, and able to combine several profiles in one policy, but it can miss some protocol anomalies, deep archive nesting, and buffer-dependent features. Proxy-based inspection buffers and rebuilds traffic, enabling the richest DLP, video filtering, ICAP, and content-disarm features at a performance cost. A question that asks for a feature unavailable in the current mode is usually testing this distinction, not a licence problem.
SSL inspection is the second axis: no inspection, certificate inspection (reads the certificate/SNI only - enough for web filtering and application control, useless for antivirus or IPS inside TLS), and deep inspection (MITM with the FortiGate CA, required for AV, IPS, DLP in encrypted sessions). Answers that claim certificate inspection detects malware payloads are wrong. Deep inspection breaks certificate-pinned apps; use SSL exemptions for those destinations.
Profile behaviour traps: monitor versus block actions still log but permit; a profile that is not attached to the matching policy does no work; profile application order matters (file filter and antivirus first, then web/application control); FortiGuard updates and licence validity gate signature-based detection, and an expired licence degrades to allow-and-log behaviour.
Worked rule of thumb: to stop a download of malware over HTTPS, you need a policy with SSL deep inspection + antivirus (block action) + a file filter, verified by watching the log's action and profile fields rather than the policy hit count.