Risk-driven development focus on identifying and treating risks as an integrated part of the development process. One then obtain an adequate security level by treating security issues at the right time for the correct cost throughout the development. The EU IST-project CORAS has developed an integrate risk management and system development process for security-critical systems based on AS/NZS 4360, RUP, and RM