If you are running both side by side it could be that ClamAV is catching them first before Cyren. We have code in place that skips the rest of the checks if it was detected as a virus or failed that check. For reference order goes

Blocked Sender check
ClamAV
Cyren
Commandline checks
Filetype restriction checks
Then last, spam checks.

Each of those (except spam) can reject the message and prevent it from falling down to the next step.

Matt, thanks for the reply.  I just turned ClamAV on.  Because we were getting a lot of virus in user inboxes.  Cyren AV only caught about 50 virus a day.  Since ClamAV came online, we are stopping 500+ viruses a day.

Stats:

9/17/2018    126

9/18/2018    32

9/19/2018    57

9/20/2018    46

9/21/2018    15

9/22/2018    17

9/23/2018    6

9/24/2018    388 - Cyren is working well?

9/25/2018    104

9/26/2018    110

9/27/2018    52

9/28/2018    164 - ClamAV was turned on around 5pm.

9/29/2018    358

9/30/2018    365

10/1/2018    400

10/2/2018    533

10/3/2018    467

When we first Turned Cyren AV on, it was blocking 300+ a day.  If you look at 9/24 date, that was a regular day for Cyren.  Day before, it only found 6 virus but I got over 100 reported infected emails from users.

Anything I can check on our end to make sure Cyren AV is working as it should?

Thanks.