No protection against malware is not just about antivirus. Antivirus is a good, solid, basic control to have in place but the protection against malware goes further and includes education, communication and additional technical controls as well as response plans and reporting.