Microsoft researchers have studied some of the exploits discovered over the past several years and the vulnerabilities they targeted. Understanding which vulnerabilities get exploited, who exploits them, the timing of exploitation, and the root causes, all help security professionals more accurately assess risk. Development practices that help minimize vulnerabilities will be discussed.