The Java Security Model has undergone considerable evolution since its initial implementation. However, due to its historical focus on securing machines against attack from hostile Java applications, it has neglected support for securing "Real World" applications. We suggest that in order to support "Real World" security the ability to insert checks into compiled code in a principled way and high-level abstract security models are required.We briefly review the evolution of the Java Security Model, outline the requirements for supporting "Real World" security for applications, discuss whether Enterprise Java Beans satisfy these requirements, introduce our approach to meeting these requirements and discuss our current work.