A properly configured firewall and network segments that keep a compromised laptop from becoming a compromised company.
A single flat network means one compromised laptop can potentially reach everything else on it. Segmentation keeps a breach contained to the part of the network it started in.
Step by Step Networks configures firewall rules and network segments that actually enforce your security policy, not just a default configuration left in place since installation.