We have antivirus. Isn't that enough?
No; and this is one of the most common false assurances in the SMB market. Traditional antivirus detects known malware signatures. Modern attackers use techniques that don't match known signatures: living-off-the-land attacks that use legitimate Windows tools, fileless malware, credential-based intrusions that never touch the disk. Antivirus misses all of these.
Endpoint Detection and Response (EDR), what's now required by most cyber insurance carriers, uses behavioral analysis to detect anomalous activity regardless of whether it matches a known signature. It's a fundamentally different technology, not an upgrade of antivirus.