@Stake have just released a study looking at the relative security of .NET vs. WebSphere (WebSphere is probably the most secure App Server for J2EE). I have to say, I trust @Stake more than most, having have a good deal of involvement them in years gone by...