Couldn't agree with you more. Every tool in the world won't help you defend against a user with privileges being phished into doing something inappropriate. A

Couldn't agree with you more. Every tool in the world won't help you defend against a user with privileges being phished into doing something inappropriate. And, even for those of us who are somewhat savvy, having refreshers to remind you things like never, ever, click on a link in an email, navigate through the website instead. Be hyper cautious about opening every attachment, period. Ensure that your system firewall is set to default deny, and think twice about opening up rules when an application demands them - and consider making them temporary rules. (Little snitch is great for that). Make sure the OS is updated routinely.... With that said, operating systems could help us out a little by reducing the almost infinite number of threat surfaces that exist so that we can more easily audit our system. The sheer number of places that an auto-launching/malware/kernel extension can hide in OS X makes it next to impossible for me to figure out whether my system has been compromised - particularly if something is able to hide itself from Little Snitch. And I won't even go into the insane number of network accesses that most applications want these days... But yes, the only sustainable security strategy is education.