Rich Picture of the state of web application security

Here's a first bash at the diagram.  I was hoping to show on the diagram (along the lines of the seminal one in the Microsoft "Road Signs" paper):

- Current attacks from a "drive-by" and "targeted attack" perspective
- Security Controls (authentication, session management, input validation etc.)