We've been using it to track worms. If a worm contacts our monitoring system, its IP address is logged and is then converted to latitude and longitude. It alls goes into an XML feed that we use with Google Earth's network links.
It looks something like this:
Click the image for a 1400x1050 view.
And while that's pretty neat, worms aren't really today's threat. So we're working on some new data feeds.
Lets take spam. This is what the source of spam from a single personal account looks like: