It's quite hard to believe that IIS 6.0 has been out for over a year and there have been 0, that's right zero as in nil as in nada as in ziltch security bulletins!