The antivirus module combines a number of features that prevent unwanted or potentially dangerous files from entering the network. These features work in different ways, such as checking the file size, name, file type, or the presence of a virus or greyware signature. In doing so, all antivirus mechanisms have simultaneous access to the traffic, ensuring that many operations can take place almost simultaneously. This significantly increases the performance of the antivirus engine.

• High Peformance AntiVirus: Fortinet's optimised anti-virus technology uses a combination of signature and heuristic detection modules to provide multi-layered, real-time protection against multiple forms of attack. Extremely high system performance is achieved through the use of FortiASIC's integrated Content Processor (CP) along with Fortinet's patented technology known as CPRL or Content Pattern Recognition Language, for accelerated virus file scanning and heuristic/anomaly detection.
• AntiVirus Techniques: Depending on the level of protection required, different instances can be activated to scan incoming data for malware. A distinction is made between pattern scan, grayware scan and a heuristic analysis. While the first two procedures check for known virus definitions, the latter can also detect mutations of known viruses or completely new virus signatures.
• Real-time updates: The efficiency of an antivirus solution is not only measured by its throughput or detection rate, but also by the speed at which signature updates arrive. Via the FortiGuard Distribution Network (FDN), this information is continuously updated and provided in real time. This process is automatic and requires no intervention by the administrator. In comparison, the Fortinet AV engine consistently ranks among the top 5 anti-virus providers.