Bruce Schneier has a excellent article on Credential Stealing as an attack vector -- possibly the most important one. Sood and my work on how banks are robbed was about credential stealing. What is credential stealing? Stealing someone's account and password. Yup, that is the most common way in. Not zero-days.