Are these machines part of a cardholder data environment (as defined by PCI-DSS)? If the answer to that is 'yes', honestly, just suck it up and install it. It

Are these machines part of a cardholder data environment (as defined by PCI-DSS)? If the answer to that is 'yes', honestly, just suck it up and install it. It will be cheaper, easier and far less annoying to install some AV in your CDE than to have to explain why you didn't in the event of a breach. (Note --- Post breach audits are my personal definition of hell.) Otherwise, anti-virus is reactive and tends to protect against the lowest hanging fruit, all while introducing a real cost to everything else you do on that machine. Personally, I'd skip AV and just do a bit of security training.