Not necessarily by the meaning of the actual cost of a certain solution.
Roughly speaking, in a company, you’re paying for the actual software, for the man hours to deploy it, troubleshoot it, and work around the occasional bugs quirks, to keep it updated, and you also pay for the hardware to run it (directly or indirectly). Then you also use up more of the IT department’s time by having them monitor the whole mess. You also might be paying for support as well.
Now think about the benefit, in a world where the custom malware market is booming. It seems that you’re using all those resources to detect old stuff.
There are countless examples, essays, papers, etc. that show how easy it is, even for relatively unskilled malware writers, to make custom binaries.
Then there’s the response time, which is infinity for custom malware. Think about that.
Also, heuristics kind of contribute to the uselessness of the solution, contrary to what they would want you to believe. In an attempt to score high in the various charts, vendors ramp up their heuristics up to the point where you need to disable the solution entirely to be able to do any real work.
There are various other aspects which have been discussed over the years in great detail.
I’m not saying antivirus solutions are totally worthless. But they cost too much money and resources, while providing a marginal benefit.
It seems to me, that as a whole, you could be spending these resources on something more useful, something that actually contributes to the overall security of your assets.
The risk gets higher when you start to rely on antivirus software to protect your ass. It won’t.