The weakest link in the chain is almost always the human sitting at the computer. Got the panicked call from a client Monday at lunchtime. "All of our documents have weird icons, someone admitted to opening an attachment to a spam email" The spam slipped through the filter, it looked like an invoice, and the finance person opened it.
150Gb of data borked. About 2 hours to restore from backup, 1/2 a day of work lost for some of their users, and 2 computers to nuke and reinstall. It could have been much worse.