I've seen a couple of them during my consulting gigs. They don't want to own any infrastructure and don't want to keep IT staff to maintain it. They indeed use

I've seen a couple of them during my consulting gigs. They don't want to own any infrastructure and don't want to keep IT staff to maintain it. They indeed use G Suite, Office 365 and cloud varieties of line-of-business apps: order processing, inventory, accounting etc. If an app doesn't have a suitable cloud alternative, it's moved to VPS and accessed via RemoteApp (at this point you apparently get some IT guy). They keep client PCs as "thin" (read "cheap") as possible. They don't have a "SWG" or "file/firewall policies" or anyone who can implement and enforce it. It's just stock desktop AV software perhaps with some initial tuning. And this resource-hungry beast is there only to scan incoming files for the ransomware-of-the-day, either downloaded from the Internet or copied from USB thumb drives. If they could deny users from downloading anything, disable thumb drives and drop AV entirely, they'd be much happier, especially that poor IT guy.