## 5 Results
_Security prioritization and monitoring_ is a set of 28 unique activities, such as protection poker and business impact analysis, that prioritize specific security goals and requirements, and monitor their implementation. _Risk management_ is a cluster of six activities, such as hazard analysis, risk identification, and risk assessment, that help to identify, assess, and control threats to developed software on a strategic level. _Security planning and threat modeling_ is a set of six activities, such as threat modeling and security modeling, for structured identification of potential operational threats (e.g., structural vulnerabilities and the absence of appropriate safeguards). _Security requirements engineering_ is a group of 10 activities, such as defining security requirements, defining security-related user stories, and formulation of abuser stories, that focus on defining, documenting, and maintaining security requirements during software design. Artifacts were grouped into five clusters, as shown in Figure 2. _Security requirement artifacts_ is a cluster of seven backlog-related artifacts, such as abuse cases and security user stories, that put a focus on security during acquisition of requirements. _Security repositories_ is a group of four artifacts, such as security requirements repository and security backlog, that provide checklists of requirements for software security. _Security reports_ is a set of five artifacts, such as security audit reports and security testing reports. These are documents written at the end of certain security activities. _Security tags_ is a cluster of three artifacts, such as security keywords and s-tags, that help developers to stay aware of the security relevance of users' stories. They point to parts of the developed software that need security verification. _Security policies_ is a group of nine artifacts, such as secure coding policies and security test plans, that help to plan software development by providing standards and solutions related to security. Figure 3 presents four clusters into which unique roles were grouped. _Security guru_ is a cluster of four roles, such as security manager and security master, that are respected for their security knowledge and who lead software engineering from the security perspective on the strategic level. _Security developer_ is a group of two roles, namely, security architect and security developer, that involve designing security tests, risk analyses, threat models, and attack surface analysis. _Penetration tester_ is a cluster with a single role responsible for testing developed software for known vulnerabilities and attack vectors. He also tries to find possible exploits in the developed software. _Security team_ is a cluster with a single team of several security-related roles, such as penetration tester, security manager, and security architect. The above presented clusters may be considered as consolidated key AES activities, artifacts, and roles, since they are composed of elements that are most similar to each other. The focus group was also able to provide descriptions of clusters that encompassed all their individual elements. Figure 1: Dendrogram of activities. It indicates seven distinct clusters: _security auditing_ (P.1), _security analysis and testing_ (P.2), _security training_ (P.3), _security prioritization and monitoring_ (P.4), _risk management_ (P.5), _security planning and threat modeling_ (P.6), and _security requirements engineering_ (P.7). Figure 2: Dendrogram of artifacts. It indicates five distinct clusters: _security requirement artifacts_ (A.1), _security repositories_ (A.2), _security reports_ (A.3), _security tags_ (A.4), and _security policies_ (A.5). Figure 3: Dendrogram of roles. It indicates four distinct clusters: _security guru_ (R.1), _security developer_ (R.2), _penetration tester_ (R.3), and _security team_ (R.4).