A method for identifying security risks in a software application, the method comprising: identifying a software context relating to the environment of the software application; selecting a customized set of security requirements for development or maintenance of the software application based on the software context and specific to the software application being developed or maintained, the security requirements selected from a security knowledge database comprising security elements; generating a prioritized task list comprising the customized set of selected security requirements, each of the security requirements comprising instructions to address the security requirement; scanning code of the software application with at least one security assessment code scanner; mapping any code vulnerabilities found by the at least one security assessment code scanner with at least one security requirement in the prioritized task list; evaluating the ability of the security assessment code scanner to identify security risks particular to the software application under scrutiny based on the software context by identifying a likelihood of a false negative result of the code scanning; indicating a confidence level of risk identification of at least one of the selected security requirements based on capability of the code scanner to verify a compliance state of the mapped security requirement and identifying vulnerabilities not identified by the at least one security assessment code scanner; and updating any security requirements in the prioritized task list for which the at least one security assessment code scanner is incapable of verifying a compliance state to indicate an unverified compliance state. identifying a software context relating to the environment of the software application; selecting a customized set of security requirements for development or maintenance of the software application based on the software context and specific to the software application being developed or maintained, the security requirements selected from a security knowledge database comprising security elements; generating a prioritized task list comprising the customized set of selected security requirements, each of the security requirements comprising instructions to address the security requirement; scanning code of the software application with at least one security assessment code scanner; mapping any code vulnerabilities found by the at least one security assessment code scanner with at least one security requirement in the prioritized task list; evaluating the ability of the security assessment code scanner to identify security risks particular to the software application under scrutiny based on the software context by identifying a likelihood of a false negative result of the code scanning; indicating a confidence level of risk identification of at least one of the selected security requirements based on capability of the code scanner to verify a compliance state of the mapped security requirement and identifying vulnerabilities not identified by the at least one security assessment code scanner; and evaluating the ability of the security assessment code scanner to identify security risks particular to the software application under scrutiny based on the software context by identifying a likelihood of a false negative result of the code scanning; indicating a confidence level of risk identification of at least one of the selected security requirements based on capability of the code scanner to verify a compliance state of the mapped security requirement and identifying vulnerabilities not identified by the at least one security assessment code scanner; and updating any security requirements in the prioritized task list for which the at least one security assessment code scanner is incapable of verifying a compliance state to indicate an unverified compliance state. <EOS>