Email & Google
The majority of threat is email bourne, with compromised sites making up the rest.
The simple answer is that it's too expensive and people still have the mindset of castle walls, plus it's not their job, nor is our in their objectives.
Most companies/public bodies see security as expense and inconvenience. People don't want to buy 2 pc licenses, or walk to a kiosk machine. Therefore there is always a human providing protection, as signatures and blacklists lag behind. Those humans want it simple, and those humans managers don't understand how complex simpler is.