From Backlog Items to Security Guidance: Towards Continuous Security Compliance — Núñez et al. (2026)

1 More Paper · Oct 8, 2026 · 1h 14m · transcript

Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief, free-form descriptions and often lack timely guidance on applicable requirements. We present an NLP-based backlog enrichment system that detects security-relevant backlog items and links them to relevant security requirements. The approach combines a security-relevance classifier with a…