Win8 comes with built-in antivirus. But of course you can buy Norton or McAfee if you like. In which case you have bigger problems than your CPU cycles.
And if the corporate world is a large target for the Surface, then it'll be expected to run with A/V software from the big vendors, regardless of what MS bundles with it. I have to run McAfee on each and everyone of my RHEL servers, despite the majority of them not having unfettered access to the Internet nor an email client.
