A system comprising: an output device (26, 28, 34); and a processor, configured to: analyze a software system, which includes an application subsystem comprising application code and a configuration subsystem comprising Infrastructure as Code, which defines a software infrastructure on which the application code is to run, so as to generate an output (27, 29) describing: one or more operations performed by the application subsystem, and one or more configurations provided for the application subsystem by the software infrastructure; the processor is further configured to based on the output, identify at least one flaw in the software system that results from a combination of the operations performed by the application code with the configurations provided by the software infrastructure; and in response to identifying the flaw, output, via the output device, an indication of the flaw; wherein the processor analyzes the software system by performing an operation selected from the group of operations consisting of: parsing software code of the software system, analyzing binary files compiled from the software code, and tracing execution of the software code, wherein the operation is performed over both the application code and the software infrastructure. an output device (26, 28, 34); and a processor, configured to: analyze a software system, which includes an application subsystem comprising application code and a configuration subsystem comprising Infrastructure as Code, which defines a software infrastructure on which the application code is to run, so as to generate an output (27, 29) describing: one or more operations performed by the application subsystem, and one or more configurations provided for the application subsystem by the software infrastructure; the processor is further configured to based on the output, identify at least one flaw in the software system that results from a combination of the operations performed by the application code with the configurations provided by the software infrastructure; and in response to identifying the flaw, output, via the output device, an indication of the flaw; wherein the processor analyzes the software system by performing an operation selected from the group of operations consisting of: parsing software code of the software system, analyzing binary files compiled from the software code, and tracing execution of the software code, wherein the operation is performed over both the application code and the software infrastructure. one or more operations performed by the application subsystem, and one or more configurations provided for the application subsystem by the software infrastructure; the processor is further configured to based on the output, identify at least one flaw in the software system that results from a combination of the operations performed by the application code with the configurations provided by the software infrastructure; and in response to identifying the flaw, output, via the output device, an indication of the flaw; wherein the processor analyzes the software system by performing an operation selected from the group of operations consisting of: parsing software code of the software system, analyzing binary files compiled from the software code, and tracing execution of the software code, wherein the operation is performed over both the application code and the software infrastructure.