a) "Java is not secure in the browser" -- I think that this is disingenuous. There is a lot of high-grade corporate software being written in Java for the browser without any security issues (IBM does this a lot). I don't think Java is inherently any more insecure than something like Javascript XSS or plain-old HTML injection attacks. As a matter of fact, Java tends to jump through many annoying hoops (see security policies[0]) that further remedy this problem. I'm not saying you should be using Java in web-apps, but that singling out (Java == insecure) is simply not true from a pragmatic point of view.
b) Phishing not really covered enough[1]. I think that this is one of the major (MAJOR) problems that larger companies have security-wise. It's not that the IT guys aren't setting up firewalls properly, but rather that some marketing ding-dong is voluntarily giving away his passwords.
c) This is related to (b), but social engineering, much like phishing, is a bigger problem than "iterating attack patterns" (yawn). The run-of-the mill non-techie people need to be educated and trained into how to be vigilant and security-conscious. You can do all the drills you want, if Bob from accounting simply hands over his credentials to bad guy X, it's all for naught.
I really do like the anomaly awareness idea though. I think that might even be a great start-up idea. Have a service that logs "anomalies" -- it simply does statistical analysis on various information (like login patterns), and when something "weird" happens (i.e. exceeding some set deviation), it alerts the security people.
[0]: http://pic.dhe.ibm.com/infocenter/wasinfo/v6r1/index.jsp?top...
[1]: http://slashdot.org/topic/bi/brute-force-and-social-engineer...