For some time now, I've configured the anti-virus software on the systems on my network to only scan files on write, not on read, on-top of a regular full scan overnight.
I base this on the assumption that for malware to exist on the drive, it must have been written there at some point and so scanning again on every read is a waste of resources.
Note that this policy I do not apply to removable drives.
Is there anything significant I'm overlooking with this approach? I'm not looking for opinions, rather ways that such protection could be circumvented which I haven't considered.