Watering hole
Poison a site your targets already visit. The prey comes to the water. Patching and isolation still apply.
A watering hole uses a website the intended victims already trust — cloned or actually compromised — so that visiting it delivers hostile software. The lure is the industry association page, not a random archive.
You cannot whitelist the entire internet. You can keep browsers current, block known-bad, use isolation for high-risk roles, and assume a 'trusted' site is still untrusted code.
Fact source: ASD's ACSC glossary.