A computer implemented method of applying a technical application security posture to a software project is described. The method allows an industry or corporate wide technical security posture to be enumerated. It further allows multiple software applications to be represented based on existing or proposed software (source code) producing a model representation of the application. Implementations of the technical security posture can then be combined with the software application model to ensure the necessary technical security posture is applied to the application implementation.