Software Blade effectiveness with and without HTTPS Inspection - sk184185

_Val_ — Mon, 27 Oct 2025 13:24:18 GMT

This new Secureknowledge article, sk184185, answers one very frequent question: Why do you want to enable HTTPS Inspection on your security GWs.

Here is what the SK says (quoting in full):

Without HTTPS Inspection, the Security Gateway can only inspect metadata such as domain names and TLS certificates. Most Threat Prevention blades cannot inspect encrypted payloads. With HTTPS Inspection enabled, the gateway decrypts traffic and allows full inspection by all blades.

Recommendation: Enable HTTPS Inspection for outbound traffic. Exclude sensitive domains such as banking sites or internal services to avoid privacy and performance issues.

Warning: HTTPS Inspection may impact performance and user privacy. Test in a lab environment before deployment.

Real-World Example

A user clicks a phishing link: example.com/login

Without HTTPS Inspection:
- URL Filtering blocks known malicious domains.
- Anti-Bot uses reputation and traffic patterns.
- Encrypted payload bypasses AV/IPS.
With HTTPS Inspection:
- Zero-Phishing analyses the page and injects browser protections.
- AV/IPS inspect files and exploits inside the page.

Blade Behavior Comparison

Feature	Without HTTPS Inspection	With HTTPS Inspection	Notes
IPS	Minimal: TLS anomalies only	Full payload inspection	Requires decrypted content
Anti-Bot / C2 Detection	DNS, traffic patterns, domain reputation	Adds payload inspection for beaconing	Detects hidden C2 patterns in HTTP POST/GET
Anti-Bot / Reputation	IP/domain reputation, TLS cert anomalies	No additional benefit	Reputation is metadata-driven
Application Control	Partial: SNI, IP ranges	Full identification via payload	Differentiates app functions (e.g., chat vs. video)
Application Control - UserCheck	Not supported	Supported via HTTP redirect	Requires decryption
URL Filtering	Domain-based filtering	Granular filtering by path, parameters	Blocking `example.com/badpage` requires decryption
URL Filtering - UserCheck	Not supported	Supported via HTTP redirect	Requires decryption
Anti-Virus	Limited on URL based filtering	Scans files inside HTTPS	Requires decrypted payload
Threat Emulation	Not available	Extracts files for sandboxing	Requires decryption
Threat Extraction	Not available	Sanitizes active content	Requires decryption
Zero-Phishing	Limited SNI-based enforcement (R82.10)	Full page analysis and JS injection	In-browser protection requires HTTPS Inspection

Re: Software Blade effectiveness with and without HTTPS Inspection - sk184185

the_rock — Mon, 27 Oct 2025 16:47:41 GMT

Thats super helpful.

Re: Software Blade effectiveness with and without HTTPS Inspection - sk184185

Lesley — Mon, 27 Oct 2025 18:05:58 GMT

Good to throw this into discussion with customers.

There should be no reason NOT to enable https inspection.

Yes it takes time to configure and yes sometimes it can give issues (like any other additional feature)

topic Re: Software Blade effectiveness with and without HTTPS Inspection - sk184185 in General Topics

Software Blade effectiveness with and without HTTPS Inspection - sk184185

Real-World Example

Blade Behavior Comparison

Re: Software Blade effectiveness with and without HTTPS Inspection - sk184185

Re: Software Blade effectiveness with and without HTTPS Inspection - sk184185