The need for empirical data of this type is critical, both for guiding future security research and to provide a well-reasoned basis for developing operational best practices.