Countermeasure graphs for software security risk assessment: An action research

The results indicate that CGs support practitioners in identifying high risk security threats, work well in an agile software development context, and are cost-effective.