The company implemented technical controls (antivirus, Anti-malware, and firewalls) and these controls are working properly.
The remaining vulnerability would be insider threat. Internal user threats (careless insider) Users who unknowingly expose the system to outside threats. This is the most common type of insider threat, resulting from mistakes, such as leaving a device exposed or falling victim to a scam. For example, an employee who intends no harm may click on an insecure link, infecting the system with malware.
The biggest security vulnerability in any organization is its own employees. Whether it's the result of intentional malfeasance or an accident, most data breaches can be traced back to a person within the organization that was breached.
For example, employees may abuse their access privileges for personal gain. Or, an employee may click on the wrong link in an email, download the wrong file from an online site, or give the wrong person their user account credentials - allowing attackers easy access to your systems.

The first line of physical defense is perimeter security, which comes from the following:
* Fencing
* Bollard posts to protect buildings from vehicle incursion
* Lighting
* Locked gates
* Security guards
* Guard dogs
* Limited access to areas of a facility
* Motion-sensing security systems

A zero-day (or 0-day) vulnerability is a software vulnerability that is discovered by attackers before the vendor has become aware of it. By definition, no patch exists for zero day vulnerabilities and user systems have no defenses in place, making attacks highly likely to succeed. One of the most common recovery methods for a zero-day attacks is to physically (or via a network-based firewall) remove all access from anyone who would have the ability to exploit it. Blocking the ports used for Remote PowerShell can limit these attacks.

Hardware must be compatible with HCL (Hardware Compatibility List).