## 5 Results
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Source** & **Activities** & **Artifacts** & **Roles** \\ \hline
[56] & Defining security requirements; Threat modeling; Risk analysis; Use of static analysis tools; Code review; Security testing; Fuzz testing; Security review & Secure coding policies; Secure design; Security keywords & - \\ \hline
[36] & Identification of security sensitive assets; Formulation of abuser stories; Abuser story risk assessment; Abuser story and user story negotiation; Definition of security-related user stories; Abuser story–countermeasure cross-checking & Security related coding standards & - \\ \hline
[13] & Security requirements analysis and planning; Threat modeling and designing; Secure code implementation; Security testing; Security training & Abuser stories; Security target; Attack trees & - \\ \hline
[57] & Risk analysis & - & - \\ \hline
[58] & Utilization of highly testable architecture extensive testing; Security refactoring; Security test cases & - & - \\ \hline
[59] & Basic security training for all stakeholders & Fundamental security architecture & - \\ \hline
[15,23] & Hazard analysis; Risk analysis & Safety product backlog & - \\ \hline
[33] & Security intention recap meetings & - & - \\ \hline
[60] & Continuous risk management; Identification of business and technical risks; Synthesizing and prioritization of the risks; Code analysis & - & - \\ \hline
[18] & Threat modeling; Dynamic code analysis & - & Security team; Security champion \\ \hline
[19] & Security training; Additional security training after change; Application risk analysis; Test plan review; Threat modeling; Threat modeling updates; Business impact analysis; Security auditing; Security testing; Attack surface recognition and reduction; Security test cases review; Test phase code review; Use of automated testing tools (fuzzers \& code analyzers); Security mechanism review; Development time auditing; Goal and criticality definition; Application security settings definition for maintenance & Documentation of security solutions; Security test plan; Threat models; Security testing report; Security audit report; Architecture security requirement; Attack surface analysis; Security mechanism review report; External interface review report; Test phase code review report; Security test case review report; Development-time audit report & Security master; Security guru \\ \hline
[20] & Vulnerability assessment; Threat modeling; Penetration testing; Code analysis & - & Security master; Security guru \\ \hline
[61,62] & Threat modeling; Risk estimation; Security goals identification; External review of the assurance case; Automated security tests and analysis & Security assurance cases; Security user stories & - \\ \hline
[21,22] & - & Security backlog & - \\ \hline
[4] & Identification of security issues; Security implementation; Verification of the software from a security perspective & S-tags; S-marks & - \\ \hline
[41] & Protection poker & - & - \\ \hline
[42] & Threat poker & - & - \\ \hline
[37] & Security analysis; Design the security requirements; Security testing & Misuse cases; Abuse cases & - \\ \hline
[63] & Security analysis; Security modeling; Security designing; Security testing & - & - \\ \hline
[38] & Generic security user stories & - & - \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._Overall, the hierarchical clustering produced 16 clusters. Figure 1 shows a dendogram of how unique activities were grouped into seven clusters. _Security auditing_ includes seven unique activities, such as security auditing, design inspection, and code review, that help to evaluate the overall security of developed software. _Security analysis and testing_ is a set of 16 activities, such as penetration testing and risk-based security tests, aiming to analyze and test the security performance of developed software. _Security training_ is a cluster of three activities aiming to increase the knowledge about security among software developers and other stakeholders.