Jul 2026· International Conference on Predictive Models in Software Engineering· 0 citations· 12 references
Computer Science
Abstract
Translating high-level business requirements into standards-grounded security requirements remains a persistent challenge in software engineering. Traditional Security Requirements Engineering (SRE) is often manual, error-prone, and too slow for modern development, creating a translation gap that can leave software vulnerable. This paper presents MAS-SRE, a multi-agent framework that automates the transformation of business requirements into traceable security requirements grounded in OWASP ASVS, NIST SP 800–53, and ISO 27001. MAS-SRE orchestrates 10 specialized agents across 4 workflow stages and combines STRIDE-based threat modeling with Retrieval-Augmented Generation (RAG) to produce standards-aligned outputs. Following the Design Science Research Process, the framework was evaluated on 14 industrial use cases through expert assessment by 15 software engineering practitioners and deterministic coverage and traceability metrics. MAS-SRE achieved 100% verification test coverage, 98.6% threat mapping coverage, 87.6% control mapping coverage, and about 40% lower processing time than sequential execution, while also receiving positive practitioner feedback on usefulness and adoption intent. These results indicate that MAS-SRE is a feasible approach for drafting standards-grounded, traceable security requirements, although comparative evaluation against alternative methods and deeper integration into development workflows remain future work.
Empirical evidence is provided that generative AI can effectively support security requirements engineering when embedded within human-centered workflows and organizational governance structures, offering practical insights for adoption in regulated software development contexts.
F. Martins, Elaine Venson· SIGSOFT FSE Companion· 0 citations
The results indicate that language-model assistance can add value in regulated automotive requirements workflows when it is embedded in deterministic, provenance-rich, and expert-governed processes.
Large Language Models (LLMs) are moving from code completion toward repository-scale agents that retrieve context, edit files, execute tools, and participate in security-sensitive workflows. The evidence for these systems, however, remains divided between software engineering evaluations centered on functional task completion and software security evaluations centered on vulnerability detection, secure generation, or exploit-oriented validation. This evidence-centered structured survey synthesizes representative work available through May 31, 2026 across software engineering tasks, software security tasks, adaptation mechanisms, artifact granularity, and evaluation design. In addition to a task taxonomy, we introduce an assurance framework that separates functional correctness, security, operational reliability, evidence provenance, and agent authority. The review shows that execution feedback and repository access can substantially improve engineering task completion, but do not by themselves establish security; conversely, static-analysis labels or vulnerability-classification scores rarely establish deployable correctness. We identify recurring validity threats--weak test oracles, duplicated and temporally leaked data, changing agent harnesses, proxy-only security checks, and under-reported budgets and human intervention--and derive a minimum reporting protocol for cross-study comparison. The resulting research agenda prioritizes jointly secure-and-functional benchmarks, repository-scale threat models, calibrated human oversight, longitudinal maintainability evidence, and reproducible agent evaluation. The central conclusion is that model capability should be judged as an assurance case supported by task-appropriate evidence, rather than by a single benchmark score.
Wei Lin, Tao Zhou, Zhaofei Xie et al.· 0 citations
The increasing complexity of modern software-intensive systems, particularly in the automotive domain, demands new approaches to bridge the gap between high-level engineering specifications and executable, safety-compliant code. This need is amplified by the rapid transition toward software-defined vehicles, where highly dynamic, updateable software functions significantly enlarge the scope and frequency of engineering activities and require scalable, transparent, and adaptive development processes. While recent advances in Large Language Models have demonstrated strong capabilities in automating tasks such as requirements analysis, code generation, and documentation, their deployment in safety-critical engineering workflows remains challenging due to the need for transparency, traceability, and controlled decision-making.This paper presents a modular multi-agent Large Language Model (LLM) pipeline that automates key steps of the systems engineering lifecycle - from requirement structuring and compliance checking to code and test generation - using specialized LLM agents orchestrated within a unified architecture. A central contribution of this work is the integration of a Human-in-the-Loop subsystem, which introduces configurable review checkpoints at critical stages such as requirements analysis, compliance assessment, code generation, and test creation. The human-in-the-loop module enables engineers to approve, reject, or modify intermediate results, ensuring human oversight, enhancing trustworthiness, and enabling adherence to functional safety standards.The system supports heterogeneous input formats and provides end-to-end traceability through structured outputs and detailed monitoring of performance metrics including model usage, token consumption, and automation efficiency. Initial evaluations indicate that the combination of multi-agent specialization and human-in-the-loop-guided oversight can significantly reduce engineering effort while maintaining the transparency and reliability required for regulated domains.By embedding controllable human supervision into the LLM-driven pipeline, this work offers a practical and scalable architecture for integrating Artificial Intelligence (AI) automation into safety-critical systems engineering processes, with particular relevance to automotive software development.
Marcel Padubrin, A. Kulzer, Erol Guerocak· SAE technical paper series· 0 citations
Late-stage defect discovery, often rooted in ambiguous requirements, significantly increases remediation costs especially in regulated industries such as fintech. We present ARC-V, a multi-agent AI system deployed at JPMorganChase that shifts quality assurance upstream by operationalising Large Language Models for automated requirement and code verification. ARC-V utilizes specialised agents to (1) assess requirement tickets against organisational standards in order to provide actionable remedial guidance; (2) verify code against requirements in order to predict defects and offer commit-level feedback; (3) continuously monitor agent performance and adoption. Post-production deployment results at JPMorganChase show that ARC-V greatly increased the quality score of user story fields with 'value statements' and 'acceptance criteria' achieving score improvements of 8.5 and 4 points, respectively. Crucially, ARC-V achieved a 79% early defect discovery rate, identifying the vast majority of production-escaping bugs before testing. These results validate a requirements-centric, AI-driven approach to scalable software quality assurance in complex environments.
Paul Baker, Blanca Manu, Rebecca Moussa et al.· SIGSOFT FSE Companion· 0 citations
The increasing regulatory complexity in automotive development places significant pressure on engineering teams to derive complete and correct requirements. This paper presents a multi-agent-based large language model (LLM) workflow designed to support requirement extraction from technical specifications and regulatory documents in compliance with automotive requirement guidelines. The approach structures the requirement derivation process across collaborating agents that interpret specification and regulatory text, generate candidate requirements for the early engineering activities, and cross-validate their outputs to improve consistency and traceability. To evaluate the applicability of the workflow in an industrial context, we applied it to the draft Euro 7 emissions regulation. The agents produced requirements for relevant functional domains, which were subsequently reviewed by domain experts at FEV. The evaluation focused on correctness, completeness, and coverage. Results indicate that the agentic workflow can achieve high alignment with expert expectations, demonstrates robust coverage of regulatory intent, and reduces manual effort in the early requirements engineering phase. The findings highlight the potential of structured multi-agent LLM systems to accelerate compliant software development processes and to enhance the reproducibility and quality of regulatory requirement interpretation in the automotive domain.
Abdelrahman Abdalla, Lukas Schäfers, Fabian Schmidt et al.· SAE technical paper series· 0 citations