I assume your comment, kryo, that it supports SSL scanning, is a good thing and that it doesn't install a vulnerable root certificate.
No, it does install its own root cert. Performing a man-in-the-middle attack with fake certificates is the only way that AV suites can scan SSL/TLS encrypted traffic before it hits the browser. They could scan the traffic after it hits the browser with browser extensions, but most don't seem to use that option any more. As noted earlier, it boils down to three questions:
- Do you trust the AV software/provider with access to the encrypted information?
- Does the AV software properly validate certificates before replacing them with fakes (PrivDog doesn't)?
- Does the AV software use unique root certificates for each installation so there is no 'skeleton key' for phishers to use against you (Superfish doesn't)?
The mere fact that they are doing it does mean that you are introducing an additional vulnerability to your system. So long as you consent to it and they do the second and third things above though, the scope of that vulnerability is pretty limited (malware has to be on your machine to take advantage of the fake root cert) compared to Superfish. So it mostly boils down to the question of trust and evaluating that risk against the risk of downloading malware on HTTPS connections (which depends as much on the user's browsing habits as anything).
Now, if you're using a business version I can't say whether that has it or not--I'm only talking about consumer versions here. Though even if the business version does not scan encrypted traffic, there is no guarantee your employer is not decrypting traffic itself with an impersonating proxy or other means.
I've never seen a consumer AV suite where it was forced always on (though it may be on by default). Personally, I'm more secure knowing my bank is actually my bank and just blocking scripts/embeds than I am having the AV snooping my private traffic and rendering me unable to personally validate site identities.
