The company implemented technical controls (antivirus, Anti-malware, and firewalls) and these controls are working properly.
The remaining vulnerability would be insider threat. Internal user threats (careless insider) Users who unknowingly expose the system to outside threats. This is the most common type of insider threat, resulting from mistakes, such as leaving a device exposed or falling victim to a scam. For example, an employee who intends no harm may click on an insecure link, infecting the system with malware.
The biggest security vulnerability in any organization is its own employees. Whether it's the result of intentional malfeasance or an accident, most data breaches can be traced back to a person within the organization that was breached.
For example, employees may abuse their access privileges for personal gain. Or, an employee may click on the wrong link in an email, download the wrong file from an online site, or give the wrong person their user account credentials - allowing attackers easy access to your systems.