Yes your a techy in English please
Historically AV scanners used a signature to identify malware. To have a signature you always had to know about the malware. Which typically mean't some people getting infected first.
So there was a time period where people would be vulnerable to that malware - until their AV got a signature for it. Balancing this was how few truly aggressive damaging malware attacks occured. This was not too bad up until ransomware hit, then a $$$ value was attached to every potential infection.
Now we have a new piece of malware going out every second (may be lots variations on existing stuff). It's practically impossible to protect users from the thousands and thousands of malware samples coming out every day. On top of that we see at least 800 unique malware released every day (ie not variations on existing stuff). This all started going big last year.
So signature based AV has had its day (but is useful for keeping out the old riff raff).
The new AV (NGAV) uses other mechanisms to detect malware (machine learning, AI, reputation based systems) and is very effective. As part of my job I need to test malware detection rates on network gear - while doing this I get to observe how the desktop AV (3rd party) works. Microsofts AV is a dog, I saw it miss stuff for 3-4 weeks. I had one NGAV running (Cylance) and was somewhat gobsmacked and how good it was (especially compared to signature based AV).
