Let's not overestimate the finding of the security consultant because some of them don't really know what they do. Of course I don't know the real report and can base my opinion only on what you wrote. But I had once to do with a report where the consultant complained that the EICAR virus was not found by a firewall when it was used as a subject of a mail, even though the intended use for the EICAR test virus says explicitly:
Any anti-virus product that supports the EICAR test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long...
Thus, detecting the code inside some byte stream inside an application or database does not cover the usage at all because it is not a file. And maybe it does not even fit the other requirements about start and length. But it would be bad if the byte stream gets actually saved somewhere as a file, like when downloaded by the browser.
There is a reason for this usage restriction of the test virus: The byte stream of a virus is not dangerous by itself. It is only a problem when it is used in a context where it can be executed, typically when it is saved as a file with a specific extension like .exe, .com, .scr, .dll etc.
But is is true that if the malicious code is already loaded inside an application it might also be executed by other means, either deliberately or due to a bug like a buffer overflow. Deliberate execution would also be possible if the code was hidden with for example encryption so it does not matter. And buffer overflow would not execute the malicious code directly but there would be some code first which exploits the buffer overflow to then execute the specific code. And even this exploit code might include some simple XOR to decode the real malicious code first.
This means that looking for the signature of malware somewhere inside some byte stream which may or may not ever be used directly in execution might cause more false alarms than be of real use. Therefore make sure that you don't execute any code yourself you have in the database and that you don't send anybody the data inside a download or save them as a single file yourself.
Apart from that enterprise antivirus products often have an API (or offer ICAP) so you can send any byte stream you want to the antivirus for analysis. This should be done inside your application on any place you consider it necessary. And of course you should be aware that this was just a test virus and that antivirus will not find all possible malware, so you never can offer a full protection.
