But I see a certain segment of small business users who have everything cloud-based, where this might take off.
I'm interested in what you said. Would it be a terrible idea for you to tell me some more about this certain segment of small business users?
They keep client PCs as "thin" (read "cheap") as possible. They don't have a "SWG" or "file/firewall policies" or anyone who can implement and enforce it. It's just stock desktop AV software perhaps with some initial tuning. And this resource-hungry beast is there only to scan incoming files for the ransomware-of-the-day, either downloaded from the Internet or copied from USB thumb drives. If they could deny users from downloading anything, disable thumb drives and drop AV entirely, they'd be much happier, especially that poor IT guy.