Where I work, we use Innoculan IT. It is set up that one server will go out and check for updates every hour, download it if there is one, then once a day the computers on the network check that server for updates. So far, it has caught any virus that has managed to get in.