To ensure the greatest chance of survival, malware authors routinely submit their creations to online scanners. They repeat this process over and over again, until they've successfully created a virus, worm, or Trojan that the scanner won't detect. And that's the one they'll use to attack your system.
This means the vast majority of new viruses, worms, trojans and other malicious software may not be detected by most antivirus or antispyware scanners until after (a) it's been discovered and (b) you've applied the necessary updates. But the malware authors have a trick for this, too. They also craft their malicious code to cripple the scanners such that the necessary updates may never take place.
Criminals are also releasing such vast quantities of new malware variants, that antivirus labs are struggling to keep up. For this reason, many traditional signature-based antivirus vendors are now adding behavior blocking and HIPS protection to their antivirus suites.
This isn't to say that antivirus isn't needed. Antivirus software is a must -- and on a properly managed system, it's invaluable. But it's not a panacea and if it's your only line of defense, chances are it will be breached. Security isn't a passive endeavor, and to stay secure you must become actively engaged in your own protection. Here's how.