Currently, we have completely defined two of the steps of the software security process, with the third well under way. We have empirically validated key aspects of the first step, and are in the process of validating the second. We plan on performing a full-scale field test of the process, together with our commercial partners, in the near future.