I'm an information security consultant with his own business. Been in the infosec business in one form or another since the early/mid 90's. I have no form of virus protection running on the computer on which I type this. Never have had it on any of my own computers. I also don't patch the OS, except for certain patches that truly can affect me remotely, e.g. GDI and IGMP corruption bugs. Knock on wood, I've never been infected by any kind of bug, except those I've deliberately infected my computers with (either by way of my job, which requires this, among other things, or by playing with software from questionable sources.) However, I always do keep web-facing software (browser, Flash, Quicktime, Adobe Reader, etc.) up-to-date, and I avoid downloading and viewing files in unpatched software like MS-Word, Excel, etc. unless they're from a known, trusted source, etc.
Not that I advocate this for most people, since most people don't have the required knowledge to know what patches to apply, which programs and file formats are unpatched, the nature of various vulnerabilities, etc. Nor, statistically, is the average user savvy enough not to download malware - by far the primary method viruses, trojans, etc. get on people's computers is
STILL social-engineering trickery, such as running fake Microsoft patches somebody sends in an email. But a small HOSTS file, a good ad-blocker, and - by far the most important of all, practicing "safe hex" - go a long way towards protecting you online.