Value based licensing/billing methods and system for security software is provided, which use an effective vulnerability protection measure provided by a new or updated IPS filter deployed on host computer to determine the licensing/billing fee of the new or updated IPS filter over a billing period. The effective vulnerability protection measure is determined based on vulnerability and host attributes, and, in the embodiment of the invention, is based on a vulnerability time gap or time protected of the host computer.