There is a big market for applications that monitor systems for unusual activity and trigger alerts or even lockdowns when there is suspicious activity. Yeah, they're even more of a burden than AV, but they're absolutely necessary for big businesses.

My company got hit once and we changed fast. In addition to increasing security, we made a big purchase for software that will keep us safe and forced it on all subsidiaries, One of our subsidiaries got hit with a malware attack last week. The impact was very minimal because they were ready.