For enterprises they provide additional compliance and reporting functionality and since people aren't admins on their machines infecting machines can be quite hard, probably limited in time to one user session.