Anti virus and anti malware is only good if the companies know it exist! Being aware and cautious is the main problem.
We have some malware which was done in house by a colleague to demo as part of the cyber awareness course I’ve started delivering. Upto date anti virus etc doesn’t pick it up. But it’s good at nicking people’s logins, screen grabs and access to their files. Makes our candidates think about it.
Prime example of daftness, I bought my Chromebook off eBay, the woman gave me her google login (taped to the box) as she didn’t know how to clear it. I had access to her entire online life. Luckily for her, I am not a criminal so I told her and suggested she changed her passwords.