Well, the infection vector represented by th web page is just a protocol handled by some vulnerable client. Indeed, you might have noted that an email can embed content for media rendering capable MUA.

I wonder about the impact of RSS feed capable clients reaching larger audiences or as embedded portions of aggregate RSS feed services. Sadly, that's not mentioned in their release. How long before embedded cookie tracking services and richer content such as Flash is being pused via RSS? That's the new defacement race/vector paradigm.

The main point of Websense, is that is served from a web site service that happens to be a new twist on the older method of using free web hosting services to deliver the malicious payloads.

Since Websense is in the business of providing content filtering services for business productivity, it would make sense that they toot the horn that assures the Websense customer base (or those using competing services/products to the coverage Websense can provide.

They sell the hard crunchy outside product and the stuff to product the creamy inside as well. What you highlight is that the soft creamy inside is no longer viable. That's exactly what they want to get more market adoption on with their client policy products.

Disclosure: I've used competing products to Websense and I'd be shocked if the other vendors didn't have something other means to trump up threat of not using the vendor products to protect the edge of networks -- then sweetly await someone to point out security requires layers and host level protection which the vendor also markets.