how do I show that all our laptops are secured

Antivirus scanners are part of cyberhygiene, not a standalone question

"All laptops have an antivirus scanner" is usually a sub-question under a broader question about basic cyberhygiene practices. Endpoint protection (the technical term for antivirus scanner, malware detection and sometimes EDR on laptops) is one of the measures that customers assess as part of training in basic practices for cyberhygiene, and overlaps with the broader access control and management of business assets — because without an overview of which laptops exist, you cannot demonstrate that they are all protected.

The evidence that customers usually want to see here is an export from your endpoint management system (Intune, Jamf, CrowdStrike, or similar) with the status of the antivirus scanner for each laptop: active, last update, last scan. A screenshot of one laptop is not proof for the fleet; a dashboard overview with all devices is. If you don't have central management, then the most honest answer is that you cannot yet demonstrate this at fleet level — that is different from "no, we do nothing", and you are entitled to clarify that distinction in your customer's portal as well.

Where this comes from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive explicitly mentions cyberhygiene and security training as one of the ten mandatory measures for entities falling under the Directive; endpoint protection in practice falls under this category. ISO/IEC 27001 elaborates on this further in Annex A, with specific control measures for malware protection and device management — which is why customers with an ISO background often ask for slightly different evidence than customers who refer directly to the NIS2 text. If you yourself do not fall under the Directive, it may be useful to first check via whether the organisation itself falls under the NIS2 directive, as that determines how significant this evidence needs to be.