I'm looking at options to enhance the security of our laptop users when they're away from the office. We do sensible stuff like no admin rights, firewall, and for antivirus we use Avira, but they're still a lot more exposed when on the road on some random internet connection than they are on the LAN behind our Palo Alto. I wondered if people had any suggestions on anything that works alongside Avira? I'm working on the principle that the two ways to stop "bad stuff" other than detection are behaviour, or by stopping the traffic to the download/payload to start with. Please keep in mind this is a business environment with potentially a few hundred laptops so deployment and central management and "hands off" for the end user plays a massive past here. I'm aware of stuff like OpenDNS Umbrella, any thoughts welcome.