It seems that the latest Workflow version is marked as a virus by Sophos Endpoint Agent:
ML/PE-A detected
I assume this is a false positive but I have seen messages on the forum about previous releases also being flagged as possible virus / malware so maybe there is something in the way the software is packaged.
Note that the designer installer does not seem to have this issue.
I will see if I can have IT flag this as false positive.