Moving outward from the network to try to secure every client is a lost cause fraught with head fakes, traps and user antagonism. It makes more sense to first move inwards and add a tighter server security layer to protect the crown jewels, before embarking on what promises to be an ambitious, expensive, lengthy, politically risky client security initiative.

Maybe this could work for SMB... but for large, disperse orgs that are 24/7 dream on.