Real-Time scanning is essential
-------------------------------------
There is a good analogy with vaccination programmes and also condom use vs abstinence around this topic.
Decent AV blocks generic attacks. I've seen a piece of malware slip though LGfL mail filter, past Symantec MSMSE into my mail store and onto my unpatched (we always run a few days behind the releases) clients, where it was identified by Sophos EndPoint Security as suspicious and blocked. A few hours later both Symant