The security of deployed and actively used systems is a moving target, influenced by factors that are not captured in the existing security models and metrics. For example, estimating the number of vulnerabilities in source code does not account for the fact that cyber attackers never exploit some of the discovered vulnerabilities, in the presence of reduced attack surfaces and technologies that render exploits less likely to succeed. Conversely, old vulnerabilities continue to impact security in the wild because some users do not deploy the corresponding software patches. As such, we currently do not know how to assess the security of systems in active use. In this project, we will conduct empirical studies of security in the real world, seeking to understand the deployment-specific factors and the user behaviors that influence the security of systems in active use. We will employ a variety of data sources, including public vulnerability databases, malware analysis platforms and Symantec’s Worldwide Intelligence Network Environment (WINE), which includes field data collected on 10+ million real hosts targeted by cyber attacks (rather than honeypots or small-scale lab settings).