You want defense in depth

There is no real way to completely stop all malicious code. The best you can do is limit the impact