Compromising an up-to-date machine is usually a bit harder than just pointing nmap at it and enumerating running services.

Getting someone to visit a web site is relatively easy.