As a result of the exhaustion of the IPv4 free address space, more and more sites are becoming dual-stacked -- that is, available over both IPv4 and IPv6. In theory, IPv6 and IPv4 are just two similar network-layer protocols, and thus security policies (e.g. open TCP/UDP ports) should be the same for both protocols for any given site. In practice, this may not be the case. This talk presents the results of a wide-scale project in which the security policies of a number of sites were evaluated over both IPv4 and IPv6, shedding light on the mismatch of IPv6 and IPv4 security policies in the real world.