This work presents the first results from an exploratory assessment of GenAI-aware threat modeling methods in a Small and Medium Enterprise (SME) setting and reports practitioners' perceptions of the usability and integration of these methods in SME development workflows, including their perceived effort and adoption challenges.
Abstract
Threat modeling remains a central task in secure software engineering, as it enables the identification of security issues from system architectures. As Generative Artificial Intelligence (GenAI) becomes increasingly pervasive across software systems, traditional threat modeling methods (e.g., STRIDE) are insufficient to assess emerging GenAI-specific risks. In this work, we present the first results from an exploratory assessment of GenAI-aware threat modeling methods in a Small and Medium Enterprise (SME) setting. For this, we conducted a rapid literature review to select relevant techniques and systematically applied three shortlisted methods to an industrial case study involving a GenAI-augmented system. The results highlight differences in the threats identified by each technique and reveal limited support for certain GenAI-specific risk categories, particularly those related to software supply chains and human-centered security issues. We further report practitioners'perceptions of the usability and integration of these methods in SME development workflows, including their perceived effort and adoption challenges.
Empirical evidence is provided that generative AI can effectively support security requirements engineering when embedded within human-centered workflows and organizational governance structures, offering practical insights for adoption in regulated software development contexts.
F. Martins, Elaine Venson· SIGSOFT FSE Companion· 0 citations
: Industrial systems are increasingly exposed to cyber threats, requiring stronger design methodologies to ensure resilience and security. In critical infrastructures, compliance with standards such as IEC 62443 is essential for ensuring security throughout the system lifecycle. This paper investigates a secure-by-design engineering process focusing on the initial architectural design and examines the role that AI-powered agents can play in supporting it, as well as the conditions required for their effective and reliable use. This study experiments with an open-source agentic framework to generate zone-and-conduit architectures from an initial system blueprint. A multi-agent workflow is implemented, including agents responsible for architecture generation, compliance verification against IEC 62443 requirements, and security stress testing using attack tree analysis. A drinking water utility case study, subject to NIS regulatory constraints, is used to compare AI-assisted and manually produced architectures. The results highlight both the benefits and limitations of AI-assisted design, leading to the identification of recommendations and open issues for further research, with potential applicability beyond the industrial domain.
C. Ponsard, Jean-François Daune· Proceedings of the 23rd Inte...· 0 citations
Security Operations Centers (SOCs) process large volumes of security events, requiring analysts to accurately detect and assess ongoing cyberattacks under time pressure. Recent advances in Large Language Models (LLMs) suggest potential benefits for security operations, yet their practical suitability for real-world SOC workflows remains poorly understood. To address this gap, we conducted 25 semi-structured interviews with SOC practitioners who had prior experience with LLMs, complemented by interactive scenarios to anticipate challenges and identify opportunities for the responsible integration of LLM-based tools into SOC workflows. We identified 15 LLM use cases grouped into six functional categories. While LLMs are valued for automating repetitive, low-level tasks such as report automation, practitioners rate high-impact tasks such as incident analysis as not yet feasible, reporting limitations in technical depth, context awareness, and organization-specific knowledge. They locate these limitations less in the models than in the readiness of their SOCs and human factors driving over-reliance. Despite concerns, practitioners express a strong willingness to adopt LLMs, describing competitive pressure that leaves few alternatives. This work contributes an empirical, practitioner-driven analysis of LLM use across SOC roles and organizations and derives concrete design and integration requirements for human-centered, operationally safe LLM-assisted security operations.
Jonas Thurner, Nadine Jost, Stefan Albert Horstmann et al.· 0 citations
Software vulnerabilities have become a recognized national-security risk, yet the volume of code and the sophistication of threats now far outpace what manual security review and the limited supply of expert security engineers can sustain. A new class of systems has emerged in response: agentic systems for software security detection, which couple large language models with planning, memory, and external tools so that they can autonomously analyze codebases, reason about program behavior, and identify, triage, and help re-mediate vulnerabilities. The field has grown rapidly but unevenly, and its terminology, capabilities, and evaluation practices remain fragmented. This paper organizes the area into a structured taxonomy along five axes: the de-tection capability targeted, the analysis paradigm employed, the agent archi-tecture, the degree of autonomy, and the evaluation methodology. We popu-late the taxonomy with representative systems, including the cyber reasoning systems demonstrated at the DARPA AI Cyber Challenge, and we use it to compare designs, surface recurring patterns, and expose gaps. We find that the strongest results combine learned reasoning with classical program analy-sis and tool use rather than relying on either alone, and that repository-scale detection, trustworthy triage, and reproducible evaluation remain the principal open challenges. The taxonomy is intended as a shared vocabulary and a roadmap for building the next generation of autonomous software-security systems.
Andi Xia· Poster Volume 0008 The 2026...· 0 citations
: AI adoption has accelerated with the rise of LLMs, and people within the field of security are increasingly exploring their practical value. Threat modelling is central to secure system development, yet it remains largely manual and the value of LLM-driven tools is unclear. Even when LLMs prove useful, selecting the right one can be more challenging than using it. This paper introduces a systematic evaluation framework for LLM-driven threat modelling tools to support tool selection, observing the general LLM-integration, governance risks, and allowing for comparison of tool output. Using Goal-Question-Metric, we derive evaluation metrics and show the value of the framework on a set of state-of-the-art LLM-driven threat modelling tools. The results show our metrics distinguish both performance and governance risks, providing a basis for organisations to ensure automation strengthens rather than burdens their threat modelling process.
Josephine Bakka, A. Brandhøj, T. Bøgedal et al.· Proceedings of the 23rd Inte...· 0 citations
The goal of this study is to understand practitioners'decision making process and security considerations in selecting and integrating AI components through an exploratory semi-structured interview study, and distill the findings into actionable recommendations for AI adopters, model providers, and researchers.
Mahzabin Tamanna, Elizabeth Lin, Sparsha Gowda et al.· 0 citations