Any visits which do not come from a browser will appear as direct, e.g clicks on links in:
- email clients
- some webmail sites
- skype
- facebook clients
- twitter clients
- mobile apps
Also encrypted.google.com doesn't pass on referral data so also appears as a direct source.
So if you think you may have visitors from the above, then try tagging links which might appear in such places with campaign parameters. This page tells you how:
http://support.google.com/analytics/bin/answer.py?hl=en&answer=1033863
The campaign tags correspond directly with google analytics fields such as source, medium and keyword, so tagging links with these parameters will ensure visitors from non-browser sources retain the correct source and medium data.