Yes,
i think that would be the smartest option.
We are not using image based backup. But we have to think about it. Also for virus scanning.
To update the pattern files, i need a open port or a internal server that hold and deploy the pattern.
Or we change our virus scanning to trend micro deep security. This could be an option.
This is nothing to do in a short time. We have to carefully plan all of these thinks.
Thanks
Frank