| As dismal as Microsoft's track record on security may be, they're generally past the point of a properly-configured client system being remotely exploitable. When there are exceptions to this, they're news. In a small company, I can trust that systems have been properly configured, or oversee said configuration myself.
In a large company, unless you intend to not give people administrative access to their own systems and cripple them to the point of near-uselessness, you will have malware floating around on your network; get used to it. Treat most of the network as untrusted, equivalent to the general internet. Remove known offenders from the network as you become aware of them. Cordon off sensitive or mission-critical systems onto separate subnets and firewall those. |
