New platforms and tools deployed via the web attract innovation, foster collaboration, and for many of us -- have changed our lifestyles (how we communicate, socialize, and pay for things). At the same time we're seeing these same technologies used as attack vectors -- with end-users being the target of choice. In this talk we'll discuss threats and attacks targeting end users such as social engineering, credential theft, malware, spam & abuse -- and the resulting problems like account takeovers, botnet activity, privacy leaks, and identity theft. We'll then discuss our successes and lessons-learned from adding additional controls both at the system level and provided directly to customers. In this presentation we will examine threats/attacks that target customers/end-users of web-delivered tools services, and the different strategies employed by system owners/companies. First, we will review attacks/vulnerabilities that have been experienced in this space in the last 12-18 months , with special attention to attacks that leveraged a service provider organization in order to exploit customers. We will look at some recent case studies where customers have been targeted to answer some key questions: What are the downstream impacts of these attacks on individual customers? Does the presence of known vulnerabilities or "safety gaps" have an effect on the reputation of the service provider in economic terms?