A computer implemented method of improved security of an application for deployment to a virtualised computing environment, the method comprising: receiving configuration information for the application, the configuration information being encoded wherein the encoded configuration information includes a plurality of categories of resource for identifying resources in each category and a plurality of identifiers of resource configuration information for each category of resource accessing a set of configuration descriptors for a known security attack, each descriptor encoding at least a portion of an application configuration so as to identify one or more descriptors matching at least part of the configuration information, each descriptor in the set having a probability that the security attack will occur in a deployed application having a configuration consistent with the descriptor, wherein each configuration descriptor encoding includes a plurality of categories of resource for identifying resources in each category and a plurality of identifiers of resource configuration information for each category of resource evaluating a risk score for a risk of occurrence of the security attack, the risk score evaluated from the probabilities associated with the identified descriptors; identifying a set of compatible alternative configurations for the application; evaluating a risk score for a risk of occurrence of the security attack for each alternative configuration; selecting an alternative configuration having a risk score meeting a predetermined threshold; and adjusting the application configuration information to implement the selected alternative configuration. receiving configuration information for the application, the configuration information being encoded wherein the encoded configuration information includes a plurality of categories of resource for identifying resources in each category and a plurality of identifiers of resource configuration information for each category of resource accessing a set of configuration descriptors for a known security attack, each descriptor encoding at least a portion of an application configuration so as to identify one or more descriptors matching at least part of the configuration information, each descriptor in the set having a probability that the security attack will occur in a deployed application having a configuration consistent with the descriptor, wherein each configuration descriptor encoding includes a plurality of categories of resource for identifying resources in each category and a plurality of identifiers of resource configuration information for each category of resource evaluating a risk score for a risk of occurrence of the security attack, the risk score evaluated from the probabilities associated with the identified descriptors; identifying a set of compatible alternative configurations for the application; evaluating a risk score for a risk of occurrence of the security attack for each alternative configuration; selecting an alternative configuration having a risk score meeting a predetermined threshold; and adjusting the application configuration information to implement the selected alternative configuration.