Our security process is a software process improve- ment (SPI) process: it runs parallel to the software life- cycle, throughout the entire lifecycle, and its output is used to improve the software development process. It consists of three main steps: vulnerability modeling, vulnerability cause mitigation, and process component definition. Although a single iteration of the process is predominately linear, steps may be revisited as required to refine the result.