In order to defend against attacks, you have to understand the attack vectors and weigh the risks.  A meterpreter shell generated into an .exe file with msfvenom won't make it through email and if it somehow did manage to make its way to a desktop, it would immediately get gobbled up by the antivirus software.  I know this for a fact because I've generated said payload and dropped it onto a desktop.  I'm not worried about .exe files.  On the other hand, I consider Microsoft Office documents a potential risk.  

I can block .exe files but I cannot block Microsoft Office documents without angering the masses.  With that in mind, what's the exposure?  Depends on the users, no?  The sender is also a factor. 

I attended Cactuscon this past weekend and there was a talk on cracking Active Directory hashes.  When I entered the room (late), it was standing room only.  For a few minutes, I listened in but eventually ended up leaving because the gist of the talk is something I already practice.  Essentially, build a cracking machine, dump the Active Directory hashes, and check for weak passwords.

My cracking machine is a Dell Precision 3600 Series workstation with an NVidia 8GB GPU.  Without the GPU, using my 400MB wordlist, it takes approximately 2.5 hours to exhaust the list.  With the GPU, it takes 7 minutes.  It's a modest cracking machine and its purpose isn't to win any contests.  I just want to get through a reasonable wordlist in a reasonable amount of time.  This meets that goal.  

I often get asked why people should care about their web server getting hacked.  The argument for their lack of concern is the fact that their web server isn’t on their corporate network so they are isolated from any potential harm. 

If I were to replace all of the photos on your website with cat memes, would you care?  Take this a step further with something offensive.  So now I have your attention -- or at least I think I do.  It gets worse. 

If your site is vulnerable to cross site scripting, we can do the Internet's version of graffiti.  Pretty simple stuff if you don't sanitize inputs.  Also about as dangerous as cat memes in that we're introducing different content but causing no real harm unless you don't like cats.