Keep in mind that PCI requirements only apply to machines within the cardholder environment - everything else is out of scope. What this means is that as long

Keep in mind that PCI requirements only apply to machines within the cardholder environment - everything else is out of scope. What this means is that as long as you isolate your cardholder environment, you don't need to deploy AV across your whole company - only on those in scope. I'm not a huge fan of AV, but I do advocate for a layered approach to security, and have to concede that AV may have some value as a "last chance" layer if malware somehow manages to get past your other defences.