1. A method performed by a computing device comprising a processor and a memory, the memory including instructions executable by the processor, the method comprising: within a software development lifecycle, decomposing a software application into elements comprising components, roles, external dependencies, and data; identifying attributes corresponding to each of the elements; identifying one or more threats to the software application based on the attributes; identifying attacks to the software application from a common task list based on the one or more threats, the common task list including a collection of previously known attacks; determining risks associated with the attacks to the software application; generating an application task list that includes countermeasures to protect the software application from the risks; developing code of the software application based on the application task list; and generating a visualization to enable a software developer to implement the countermeasures during the software development lifecycle.