Abstract: A software development system provided with: a threat database which retains data indicating one or more threats that are factors that cause risks in information security to occur; and a threat analysis tool unit which, with regard to individual elements of a control model which is created from design information for a development target by a model-based development system and simulates the development target, extracts data of corresponding threats from the threat database to thereby create and output threat list data that indicates a plurality of threats for the control model.