APM Antivirus option. It does not work normally.

Make sure you're running the latest version of EPSEC software (it's not the same as the BIG-IP software you're running -- different download). The updates fix broken Antivirus engines, add new ones, and remove old ones. I suspect this may be the issue.

It's a cat and mouse game (or cat, mouse, and chipmunk game I suppose). The AV engines update their software, and then OPSWAT has to play catch-up to fix whatever needs to be fix in order to interrogate those softwares. Once that happens, F5 then needs to take that OPSWAT update and engineer-up another version of EPSEC, test and publish the download. At that point, you can download and install it on your BIG-IP.

Hey F5 - create a way to automate this please. It would be useful for some environments!

Another option would be to configure workarounds in APM for AV's that are critical to your environment, but not supported in EPSEC for whatever reason. This is a last-resort type thing... but might be an option if the person complaining is your CEO. A type of workaround might be something like a "pass if service name X is running" in the VPE. Not ideal by any means.