If you follow the first four rules you’ll likely never encounter a situation where you’d be able to say, “I should have been running my antivirus program!” That doesn’t mean you should not use one.
Most operating systems have antivirus, firewall and other security features baked in these days. In response, much malware is now repackaged for each device to prevent signature detection, and randomly or cyclically encrypted to prevent heuristic detection.
You don’t need to purchase an antivirus program, though. The one baked into the operating system is as effective as any other against emerging threats. More importantly, the weak link is rarely the security software.
Almost all malware can be avoided if the user is taught to ask questions and “just say no.”