Specific offerings fall into the following areas:
- Training, policy and organizational capabilities, including security and privacy training and advice on how to implement the practices and tools recommended by the SDL
- Requirements and design, including risk analysis, functional requirements, and threat modeling
- Implementation, including use of banned APIs, static code analysis, and code review
- Verification, including dynamic security testing and web application review
- Release and response, including attack surface and threat model reviews, final security review, and response planning and execution
- Security tools, such as static analysis tools for the Implementation Phase and dynamic and binary analysis tools for the Verification Phase