New business-critical services demand for a holistic SDLC that includes the management of risk and cost. This enables to assess the economics of security solutions for software services and systems, during all phases in the engineering process.