Hi Uncle Bob, It seems today that everybody and their mothers are adopting "micro-services" or service-oriented architecture. So, I would like to get your opinion on the use of this pattern. Feel free to give your general thoughts, but I had these questions in mind: For the average org, is SoA successful more often than not and can successes or failures be directly attributed to SoA? Do you see SoA as a lasting trend? Also, I want to thank you for taking the time to do this AMA! You're an inspiration to us all.

To let a (trusted) person to attempt exploiting your security is basically the concept of penetration testing or "red teaming". It is a very common and recommended practice in security. Some industries even require such testing to be conducted periodically. I want to hone in on the "full force" aspect: Good pen tests should model real-world threats. Real-world threats absolutely can be 'full-force'; a skilled, focused, and determined hacker wouldn't hold back. Usually pen tests set boundaries to avoid major disruption/damage to systems, but these boundaries may prevent testing for certain vulnerabilities. In other words, there is a balance. A good pen testing company can walk you through this and setup proper boundaries for your risk model.