Sounds as if you have great security in place. But let me give you just one scenario of what happens with many companies. An employee takes a laptop home, surfs the Internet via the home connection and gets infected, then brings the computer back to the office. If the bot is being controlled by http – would the company's perimeter defenses still be able to spot that? Maybe so in your case, but the experts say that many smaller companies don’t have the resources to pay for, and manage, all the layers of security needed to defend against bots.