"...how will users react to a new virus attack where the AV vendors don't have signatures out, yet they have infected email attachments to process in their in-boxes?"

Having gone through just such an event, it's not only important to have security awareness training for users, but it's also important to have suitable training for administrators, as well. During the incident I was involved in, I spent my time and energy organizing several sysadmins to assist in containment and eradication procedures, while on admin got on the phone with our A/V vendor. While he was on hold, he decided to do his own "analysis". Since then, I have seen others (CERT members, admins, etc.) attempt to do the same sort of thing...and it's a mess. To often, they spend no time thinking about such things ahead of time, and when they get into a situation in which they feel the need to do *something*, they invariably end up missing some really simple steps along the way. This is seen time and time again in the public lists.

On an aside, the issue of interconnectivity applies to users, as well (bear with me here...). Just as networks are becoming more and more interconnected, one also has to keep in mind that policies and awareness are, too. For example, a company I worked for got hit by an email-borne worm. Users were instructed to (a) do not open email if they don't know the sender, and (b) if they do know the sender, but the attachment doesn't look quite kosher, don't open it. Well, one of our customer's marketeers had a habit of sending jokes and animated files (animated GIFs, Flash movies, etc.) to people he knew, so when the email arrived, the marketing folks who received it immediately double-clicked on the attachment. While we were trying to reiterate and enforce our policies and awareness, we had a customer who wasn't quite on board with that sort of thing.

H. Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com