So, you have an IT person/team and an Anti-Virus
Are you really protected?
Do you review your anti-virus logs?
Do you have the knowledge and understand the Logs or is it all gibberish?
Who is your expert security team with the experience to help when you are attacked?
Do you have 24/7 monitoring and a team that can respond to threats quickly?