There are various scenarios where the Content Analysis (CAS) fails to update the license/subscriptions or download the latest anti-virus (AV) and Malware Analysis (MA) patterns. These include but are not limited to:
The CAS device is located behind a firewall
The CAS device does not have direct access to the Internet
The CAS device can only access to the internet via a ProxySG or ASG device
Resolution
Verify that the CAS is allowed to access the required URLs on your Firewall and/or Proxy.
These are listed in the admin guide Page 20 in the 2.4.1.2 version of the guide, just search for "Required URLs"