Security professionals have a finite budget, to cover a seemingly-infinite range of threats. The only answer is to take an integrated approach to computers and staff. Trusted "white lists" of applications can make PCs invulnerable to viruses and Trojans; and an enterprise-wide approach to authorisation can ensure that businesses aren't brought to their knees by inadvertent user actions.