Zero-days? Sexy, sure, but crap passwords and phishing are probably more pressing

Security experts poke holes in RAND vulnerability study

A new study from RAND Corporation concluded that zero-day vulnerabilities - security flaws that developers haven't got around to patching or aren't aware of - have an average life expectancy of 6.9 years."