You have to learn the hard way. Last winter, we decided to spruce up our site and use a custom font webkit (LinuxLibertine) that we got via Font Squirrel. The font looked great on our site and worked across the board – IE included. However, we did hear mutterings of some people with very high security settings being prompted to accept the font. We did not dig deeper.
This past week, we decided to run some A/B tests on the font to determine whether or not it was impacting our traffic. Low and behold, the custom font dramatically reduced the engagement on the site. Sigh, back to Times New Roman.