The Chief Information Security Officer (CISO) is asking for ways to protect against zero-day exploits. The CISO is concerned that an unrecognized threat could compromise corporate data and result in regulatory fines as well as poor corporate publicity. The network is mostly flat, with split staff/guest wireless functionality.

Cloud-based antivirus solution, running as local admin, with push technology for definition updates 

Implementation of an off-site datacenter hosting all company data, as well as deployment of VDI for all
client computing needs 

Host-based heuristic IPS, segregated on a management VLAN, with direct control of the perimeter firewall ACLs 

Behavior-based IPS with a communication link to a cloud-based vulnerability and threat feed