You're right that Perforce has little to do with the actual exploit, but "human error" and "user stupidity" don't explain all of it. First, if you're in a corp

You're right that Perforce has little to do with the actual exploit, but "human error" and "user stupidity" don't explain all of it. First, if you're in a corporate environment, your default browser is often chosen for you, even as a developer. Furthermore, you may not even have sufficient permissions on a Windows box change it. Second, This is not an end-user problem. People are trained to click links. We click lots of them. If you put them in emails, someone is likely to click them. Perhaps they click during a moment of distraction while in a teleconference, working from home with a screaming 2 year old in the background. It happens. As a general rule I am very wary of links placed in emails. But when I get work email from coworkers, especially something work-related, on my work email system, I often just click the link because the odds of it being phishing are incredibly low. I'm certain these weren't exactly "Get VIAG'A cheap" emails. The problem is that nobody is perfect. This does not make them stupid, it makes them human. If your security model relies on everyone being 100% vigilant 100% of the time, it fails. Somehow, systems need to evolve to add some more layers of security to backstop all us unreliable humans.