>But I guess my question boils down to "how often does anything really happen?"
Snip>

Obviously it deals with how great a target your business is perceived of to a hacker, the number of people who use your inter/extra net applications, if these apps use the same data as your local applications and the degree of exposure you e-mail addresses are subjected to.
There is probably not a 15 minute period that goes by where something isn’t trying to execute code on our public servers. Often we get hundreds of break in attempts a day. We deal with a lot of people from all over the world. Any one of them can get a virus and we are at risk of getting it. We do need to get files from clients and if a virus is ahead of definitions, we have a problem. As far as security and MS go, I handle most of it with the logical network config and at the firewall. I never had a problem that was due to a MS flaw. (At least that I know about)