You think hacking is the biggest security threat on the World Wide Web? Time to rethink. According to Microsoft's bi-annual Security Intelligence Report, rogue software and the lost and stolen PCs are the biggest culprits.

Here are the top seven security threats to our PCs.

Lost and stolen equipment, not computer hacking, continue to be the most common cause of security breaches. Over 50 per cent of the security breaches (that led to data loss) reported in second half of 2008 were a result of stolen or lost PCs.

To mitigate this threat, organizations must implement strong data governance practices to help protect data from criminal access.

Also known as "scareware," it takes advantage of users' desire to keep their computers protected. The rogue software lures users into paying for protection that is actually malware offering little or no real protection, and is often designed to steal personal information. The Microsoft Security Intelligence Report shows that such programmes are now among the top threats across the world.

For example, two rogue families, Win32/FakeXPA and Win32/FakeSecSen, were detected on more than 1.5 million computers by Microsoft, catapulting them into the top 10 threats in the second half of the year. In addition, Win32/Renos, a threat that is used to deliver rogue security software, was detected on 4.4 million unique computers, an increase of 66.6 per cent over the first half of 2008.

Rogue security software and other social engineering attacks such as these compromise people's privacy and are costly; some take personal information and drain bank accounts, while others infect computers and rob businesses of productivity.

The report also showed that as software companies have improved the security of their operating systems, attackers have shifted their focus to the application layer, where the majority of vulnerabilities are now being reported; nearly 90 per cent of vulnerabilities disclosed in the second half of 2008 affected applications.

A home user is usually targeted by a Trojan attack. While for enterprises, the weapon of choice is a worm attack. The biggest difference between enterprise and home vulnerabilities is social engineering.

The social engineering messages used in connection with rogue security software may be less effective in an enterprise environment, where malware protection is typically the responsibility of the IT department.

Worms rely less on social engineering to spread than Trojans and downloaders. Worms channels include unsecured file shares and removable storage volumes, both of which are often plentiful in enterprise environments.