Standardising business application security assessments with pattern-driven audit automations · Study