Many of the high-volume security incidents reported by CERT involve advisories that have been reported and fixed by the product vendor months, or even years, earlier. Social Engineering has been identified as an important element of security exploits. It can best be described as getting people to compromise their own systems by predicting their reaction to a given set of circumstances - knowing what your enemy is going to do before they do. Increasingly, virus authors are not only writing elegant code, but are spending more time on the human side of the equation and are getting better at finding ways to exploit a user's trust. Social engineering has long been discussed in the hacker community.
Government is behind.
The actions of many governments have not helped the cause of security. Legislators continually struggle with a rapidly moving technological target. The U.S. government's misguided encryption export policies tend to have the effect of keeping strong encryption out of the hands of those who need it. Beyond encryption policy in the U.S., a more global problem of detection, apprehension and prosecution of cybercriminals plagues all governments. A cloak of anonymity, and attacks that can be conducted from offshore locations, leads to a difficult process of gathering of evidence and identifying perpetrators.