Then the attacker could buy ads on a site they suspect you will visit. As long as the employee need to be able to browse the internet any whitelisting of links

Then the attacker could buy ads on a site they suspect you will visit. As long as the employee need to be able to browse the internet any whitelisting of links seems like a waste of resources.