There was a big hack recently in Ireland that had taken out the health service IT systems, with a ransom demand. The entry point there was what seems like social engineering, they got an employee to call a number from a Web popup claiming they would fix their computer, and of course then proceed to infiltrate further. This is not hacking in that a SW bug was not exploited, but is effective. Unless employees have no way of running unsigned (by the employer/trusted source) code, its hard to see how this kind of weakness is prevented.