Many software organizations are overwhelmed with a laundry list of vulnerabilities. They often have no idea where to start, how to determine prioritization, and whether or not those vulnerabilities accurately represent the threats to our applications, users, and data. Threat modeling is a simple yet effective solution.

There are lots of good practices that people will tell you aren’t agile. Usually this comes from people who read a book on Scrum or Extreme Programming and took it literally. But agile is not methods and tools associated with a particular methodology; as long as you follow the agile principles, anything is fair game.

Many explanations of relative sizing in agile estimation fail to capture the mix of knowledge, skill, and effort involved in completing a task. Learning to play a song seems to capture the core ideas of estimation. With a metaphor, it is easier to come up with baselines to estimate against for your own agile sizing.