IIS vs Apache vulnerabilities chart.
Michael Howard just posted this analysis of relative vulnerabilities between IIS6 and Apache 2.0 during the year after their respective releases.
A fascinating post, and it goes to show that maybe we really DO understand what we're doing.
Edit: I make this post, and what does Michael do? He posts a second set of charts :)