This type of security tool typically operates in conjunction with installing some extra authority on client machines (for outgoing connections) and&#x2F;or in reverse by installing the server&#x27;s private key&#x2F;cert information (for incoming connections). Having done so, the device can then effectively MITM the organisation&#x27;s own traffic.<p>This can be quite effective if you have control of the client machines on your network and can reliably configure them to trust your choice of authorities. For example, this might be true in a university computer lab or in a corporate office where IT staff administer all the machines and staff don&#x27;t have admin rights to change anything. Now your anti-malware scanners and the like can operate on things like HTTPS traffic in the same way they would on any other connection.<p>It doesn&#x27;t work if you have other machines that don&#x27;t have the extra authority installed and therefore don&#x27;t trust the intermediary. Typically, either you&#x27;ll just see the same security warnings as you would for any other MITM threat, or they&#x27;ll block the traffic and you won&#x27;t be able to connect at all over an unauthorised encrypted link. Either way, all they see will be your encrypted traffic. Clearly it would be rather unfortunate for the entire global security infrastructure if this were not the case...<p>I note in passing that, other things being equal, this kind of technology is a good thing for security. There are more powerful tools available than the kind of antivirus software typically installed on individual workstations, and they are no more necessarily recording HTTPS traffic than any other traffic that they scan. But of course you&#x27;re still MITMing someone else&#x27;s traffic, and the person sending that traffic has only your word for it that you&#x27;re not configuring tools to record the &quot;temporarily&quot; decrypted data stream or otherwise process the data in unexpected ways.<p>There have already been lawsuits about this kind of comprehensive monitoring of network traffic in the workplace. Obviously it can look bad if for example an employee was using what they believed to be an encrypted connection to their bank to check that some legitimately employment-related payment has been received, but because it was from a work computer and intercepted that connection wasn&#x27;t actually secure. The results haven&#x27;t been completely one-sided so far; it&#x27;s a complicated issue, and there are elements of both an employer reasonably wanting to know what is happening with their own IT systems and the reasonable expectations of privacy of an employee to balance.