Employees are human who can make some error any time they neglect the work security. Employee can risk an organization by download some unauthorized software, software that can contain viruses or malware that endanger the company. Why employee downloaded the false program? Because company doesn't have a program that can answer employee need. So the way out of this problem is to use a genuine program what can update and patch some bug of program and maintenance system security to lower risk of data stealing and prevent company’s system ruin.
Ignore using Email server can have problems, if you aren't sending data via Email sever such as sending by instant messenger, data won’t viruses scanned that risk an organization.
You can’t wipe out all of employee mistake, but you should be protect your company security fullest possible.