Advancing software security in the EU