Customers' increasing need for secure software products is causing many software vendors to change their development processes. Where vendors previously delivered static products at discrete intervals, many now constantly monitor their already-shipped products for reported security vulnerabilities, and provide security patches in real time. Microsoft has had such a process in place for over a year. This talk will discuss the process - what has worked and what hasn't worked - and will be of interest both to vendors and customers.