> The point is that the MITM proxy can scan the traffic for malicious content and block it before e.g. it reaches a browser. The difficulty is identifying the

> The point is that the MITM proxy can scan the traffic for malicious content and block it before e.g. it reaches a browser. The difficulty is identifying the malicious traffic in an automated way, your own machine can scan it to - but most likely your browser is already patched for known vulnerabilities (maybe if someone is still running old IE versions in your office this could be beneficial). Secondly, you don't need to proxy to scan malicious sites, if you have a dedicated machine (or third-party service) that sees an outgoing request and if the address is not in it's safe-list, it tests that request by duplicating it (you can have a netfilter hook in your firewall blocking packets from 'non-safe' sites or delaying for validation from the dedicated device/service). This doesn't require a MiTM proxy in the SSL connection. The SSL connection MiTM as far as I understand is only necessary if you want to check for malicious data being injected into an authenticated, non-publicly accessible site or form. Having one dedicated device which is re-routing office traffic through it's own SSL cert means that if that single device is compromised, so is the entire network.