A3 Thinking is a logical problem-solving tool to capture critical information and define the focus and constraints of the team. Later, it becomes a measure to test our outcomes against. An A3 report (so called because it fits on a piece of A3-size paper), composed of seven elements, embodies the Plan-Do-Check-Act cycle of experimentation:

As software engineers and architects our job is to try to use our technical and logical thinking skills to identify which is which and to challenge those that are not useful. Which activities help us to really be secure and which are outdated or simply useless “security theatre”? If we don’t do this then all security activities will be devalued and