Any visits which do not come from a browser will appear as direct, e.g clicks on links in:
- email clients
- some webmail sites
- facebook clients
- twitter clients
- mobile apps
Also note (see wikipedia) that if a website is accessed from a HTTP Secure (HTTPS) connection and a link points to anywhere except another secure location, then the referer field is not sent.
So a site like encrypted.google.com doesn't pass on referral data, and also appears as a direct source. However, although logged in google users use ssl, google passes on all referral data except the search term.
So if you think you may have visitors from the above, then try tagging links which might appear in such places with campaign parameters. This page tells you how:
The campaign tags correspond directly with google analytics fields such as source, medium and keyword, so tagging links with these parameters will ensure visitors from non-browser sources retain the correct source and medium data.