virus protections

these days: every machine implements host firewalls with virus fingerprint matches

compare it
use a secure OS that does not need upgrades
download virus signature every week

multiply it by number of people, and add up IT people coming down for troubleshooting x trouble probability

of course, if the user have clicked a wrong link, we can do very little about that
still, we can protect browsers from being hijacked