The company I work at has two layers of security, the first being a quite good firewall and proxy system called IPCop (http://ipcop.org/), the second one being the content filter eSafe (http://www.aladdin.com/esafe/).
Only after the net traffic is scanned by those two, it reaches our computers. We rarely get any kind of virus, and the last couple of times I remember they were brought inside and not downloaded (usb pens/laptops from outside the network, etc)