I think that whether or not you blame the individual is dependent upon the critera defining the situation. Normally I would agree that the admin is at fault. However, think back to the I Love You! virus. No virus definitions were quickly available to detect the virus and we were forced to depend on e-mail warnings and employee training. I was of the opinion that if you received 30 copies of an e-mail all with the same subject line, then anyone with the lick of since equal to a doorknob should have suspected that this might be a virus. Unfortunately our employees seem to conviently forget this. I even had one employee to open that particular virus 3 times, before the updated detection files were released. What do you do?