They say an antivirus won't stop all attacks, and organizations should consider isolation tools.