Then you reduce the attack surface on this one special-purpose machine, which is much easier than doing the same on all your employees' desktops.