## 6 Discussion  
This paper aimed to offer an overview of security solutions proposed in the literature by disassembling proposed AESS approaches and methods into atomic parts (i.e., security elements) and consolidating the overlapping ideas. The consolidation process was performed using a mixed-methods approach, combining qualitative and quantitative methods. The consolidated security elements (i.e., clusters) can then be used by the practitioners as general guidelines that are presented concisely and interpretably while still allowing distinct elements to be traced back to their sources, as presented in Table 1. On the other hand, such an overview can also be used by researchers when analyzing knowledge gaps and designing future research. Hence, this paper yields several theoretical and practical implications. First, this study comprehensively reviews the literature on AESS. Although some papers reviewed AESS (e.g., [7; 64; 65]), this is among the first studies to comprehensively amass a number of AESS approaches and decompose them into corresponding activities, artifacts, and roles. Such a generalized overview of the proposed security solutions should help practitioners and researchers understand the current state of the research on AESS. More particularly, our research offers insights into the available security elements and exposes the ones that should have received less attention, indicating research gaps. Second, the research on AESS topics is diverse, and at first glance, individual studies and/or security solutions are seemingly not directly comparable. The clustering results presented in this study introduce the baseline, by which present (and potential future) research and security solutions can be compared. The comparisons can be made among the security solutions where security elements are categorized within the same clusters. Third, this research gave an overview of AESS approaches and their constituent activities, artifacts, and roles. This list can aid practitioners looking for established, off-the-shelf AESS approaches. Although implementing an off-the-shelf AESS approach may not work well in specific settings, it may still offer a good starting point for software enterprises looking to upgrade their software engineering process, for example, for transitioning from near-zero security \"as agile as it gets\" software engineering towards more security-focused development of software. Evaluation of security elements independently of each other allows enterprises to modify their existing method only slightly by including only one most suitable element for their needs. The needs may vary from project to project. For example, some projects may require the highest levels of security, and others may call only for basic security requirements. Such an overview of security elements, as presented in this paper, where most security elements found in the literature could be placed in one of the clusters, offers decision-makers and agile teams a comprehensive list to choose from. Whether they seek low-hanging fruits or comprehensive security solutions, our results can serve as a checklist for enterprises when attempting to improve their development methods in terms of security. Additionally, the clusters reveal the variety and the range of security elements the development enterprises can use. For example, if the enterprise aims to implement a security review in its development process, our results enable them to gain insights into the variety of security review measures and several different possibilities at their disposal. Fourth, this study is one of the first to attempts at the qualitative-quantitative consolidation of the multitude of different activities, artifacts, and roles related to AESS found in the current literature. The identified clusters resemble the core engineering phases of secure software proposed by [66]: software requirements security, software design security, software construction security, and software testing security.