Enhancing Secure Software Development with AZTRM-D: An AI-Integrated Approach Combining DevSecOps, Risk Management, and Zero Trust
Source abstract
Abstract
This paper introduces the Automated Zero Trust Risk Management with DevSecOps Integration (AZTRM-D) framework, a novel approach that embeds security throughout the entire Secure Software and System Development Life Cycle (S-SDLC). AZTRM-D strategically unifies three established methodologies: DevSecOps practices, the NIST Risk Management Framework (RMF), and the Zero Trust (ZT) model. It then significantly augments their capabilities through the pervasive application of Artificial Intelligence (AI). This integration shifts traditional, often fragmented, security paradigms towards a proactive, automated, and continuously adaptive security posture. AI serves as the foundational enabler, providing real-time threat intelligence, automating critical security controls, facilitating continuous vulnerability detection, and enabling dynamic policy enforcement from initial code development through operational deployment. By automating key security functions and providing continuous oversight, AZTRM-D enhances risk mitigation, reduces vulnerabilities, streamlines compliance, and significantly strengthens the overall security posture of software systems, thereby addressing the complexities of modern cyber threats and accelerating the delivery of secure software.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Big Data and Business Intelligence · Software Engineering Techniques and Practices
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Electrical Engineering and Computer Science, Florida Atlantic University, 777 Glades Road, Boca Raton, FL 33431, USA
References (78)
Show source-provided references
1. Comparative Study of Different SDLC Models10.22214/ijraset.2021.38736 ↗
2. Olorunshola, O.E., and Ogwueleka, F.N. (2020, January 11–12). Review of system development life cycle (SDLC) models for effective application delivery. Proceedings of the Information and Communication Technology for Competitive Strategies (ICTCS 2020) ICT: Applications and Social Interfaces, Udaipur, India.10.1007/978-981-16-0739-4_28 ↗
3. A systematic literature review of the current state and challenges of DevSecOps
4. Chahar, S., and Singh, S. (2024, January 21–23). Analysis of SDLC Models with Web Engineering Principles. Proceedings of the 2024 2nd International Conference on Advancements and Key Challenges in Green Energy and Computing (AKGEC), Ghaziabad, India.10.1109/AKGEC62572.2024.10868694 ↗
5. de Vicente Mohino, J., Bermejo Higuera, J., Bermejo Higuera, J.R., and Sicilia Montalvo, J.A. (2019). The application of a new secure software development life cycle (S-SDLC) with agile methodologies. Electronics, 8.10.3390/electronics8111218 ↗
6. DevSecOps: A Systemic Approach for Secure Software Development
7. Shahin, M., Babar, M.A., and Zahedi, M. (2017). DevSecOps: A multivocal literature review. arXiv.
8. Fu, M., Lyu, M.R., and Lou, J.G. (2024). AI for DevSecOps: A Landscape and Future Opportunities. arXiv.
9. Analysis and design of student guidance information system through software development life cycle (sdlc) and waterfall model10.51519/journalisi.v5i1.443 ↗
10. Saravanos, A., and Curinga, M.X. (2023). Simulating the software development lifecycle: The Waterfall model. Appl. Syst. Innov., 6.10.3390/asi6060108 ↗
11. A comprehensive research analysis of software development life cycle (SDLC) agile & waterfall model advantages, disadvantages, and application suitability in software quality engineering
12. Application of Waterfall SDLC Method in Designing Student’s Web Blog Information System at the National University
13. SDLC model selection tool and risk incorporation
14. A v-model software development application for sustainable and smart campus analytics domain
15. Shylesh, S. (2017, January 3–4). A study of software development life cycle process models. Proceedings of the National Conference on Reinventing Opportunities in Management, IT, and Social Sciences, Bangalore, India.10.2139/ssrn.2988291 ↗
16. Mahmood, S., Niazi, M., and Alshayeb, M. (2022, January 25–26). Security in DevOps: A systematic mapping study. Proceedings of the 17th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE), online.
17. A systematic literature review on security issues and challenges in DevSecOps
18. Realizing security as code for DevSecOps
19. Department of Defense Chief Information Officer (DoD CIO) (2021). DoD Enterprise DevSecOps Strategy Guide, Department of Defense Chief Information Officer (DoD CIO).
20. Khari, M., and Kumar, P. (2016, January 16–18). Embedding security in software development life cycle (SDLC). Proceedings of the 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India.
21. Arrey, D.A. (2019). Exploring the Integration of Security into Software Development Life Cycle (SDLC) Methodology. [Ph.D. Thesis, Colorado Technical University].
22. Chun, T.J., En, L.J., Xuen, M.T.Y., Xuan, Y.M., and Muzafar, S. (2025, June 13). Secured Software Development and Importance of Secure Software Development Life Cycle; TechRxiv Preprints. Available online: https://www.techrxiv.org/doi/full/10.36227/techrxiv.24548416.v1.
23. Lee, M.G., Sohn, H.J., Seong, B.M., and Kim, J.B. (2016). Secure Software Development Lifecycle Which Supplements Security Weakness for CC Certification, International Information Institute (Tokyo).
24. Portell Pareras, O. (2023). DevSecOps: S-SDLC. [Bachelor’s Thesis, Universitat Politècnica de Catalunya].
25. Exploring software security approaches in software development lifecycle: A systematic mapping study10.1016/j.csi.2016.10.001 ↗
26. Horne, D., and Nair, S. (2021). Introducing zero trust by design: Principles and practice beyond the zero trust hype. Advances in Security, Networks, and Internet of Things, Springer.
27. Reducing industrial risk with AI and automation
28. Ambush from all sides: Understanding security threats in open-source software CI/CD pipelines10.1109/TDSC.2023.3253572 ↗
29. Automating threat modeling for DevSecOps using machine learning
30. The zero trust supply chain: Managing supply chain risk in the absence of trust10.1080/00207543.2021.1884311 ↗
31. A novel discrete conformable fractional grey system model for forecasting carbon dioxide emissions10.1007/s10668-024-04479-8 ↗
32. Khan, H.U., Khan, R.A., Alwageed, H.S., Almagrabi, A.O., Ayouni, S., and Maddeh, M. (2025). AI-driven cybersecurity framework for software development based on the ANN-ISM paradigm. Sci. Rep., 15.10.1038/s41598-025-97204-y ↗
33. National Institute of Standards and Technology (2018). Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, U.S. Department of Commerce. Technical Report NIST Special Publication (SP) 800-37r2.
34. Locascio, L.E., and Director, N. (2025, July 20). NIST Risk Management Framework (RMF) Small Enterprise Quick Start Guide; National Institute of Standards and Technology, Available online: https://www.nist.gov/publications/nist-risk-management-framework-rmf-small-enterprise-quick-start-guide.
35. Majumder, S., and Dey, N. (2024). Risk Management Procedures. A Notion of Enterprise Risk Management: Enhancing Strategies and Wellbeing Programs, Emerald Publishing Limited.10.1108/9781837977352 ↗
36. McCarthy, C., and Harnett, K. (2014). National Institute of Standards and Technology (NIST) Cybersecurity Risk Management Framework Applied to Modern Vehicles, Department of Transportation. National Highway Traffic Safety. Technical report, United States.
37. Strategic risk management using the NIST risk management framework10.1080/07366981.2016.1160713 ↗
38. Reimanis, D. (2025). Risk Management Framework. Realizing Complex Integrated Systems, CRC Press.10.1201/9781003188377-35 ↗
39. Stoltz, M. (2024). The Road to Compliance: Executive Federal Agencies and the NIST Risk Management Framework. arXiv.
40. The significance of artificial intelligence in zero trust technologies: A comprehensive review10.1186/s43067-024-00155-z ↗
41. Ferreira, L., Pilastri, A.L., Martins, C., Santos, P., and Cortez, P. (2020, January 22–24). An Automated and Distributed Machine Learning Framework for Telecommunications Risk Management. Proceedings of the ICAART (2), Valletta, Malta.
42. Automated risk management based software security vulnerabilities management10.1109/ACCESS.2022.3185069 ↗
43. Pandey, P., and Katsikas, S. (2023). The future of cyber risk management: AI and DLT for automated cyber risk modelling, decision making, and risk transfer. Handbook of Research on Artificial Intelligence, Innovation and Entrepreneurship, Edward Elgar Publishing.10.4337/9781839106750.00028 ↗
44. Swaminathan, N., and Danks, D. (2024). Application of the NIST AI Risk Management Framework to Surveillance Technology. arXiv.
45. Sterbak, M., Segec, P., and Jurc, J. (2021, January 11–12). Automation of risk management processes. Proceedings of the 2021 19th International Conference on Emerging eLearning Technologies and Applications (ICETA), Kosice, Slovakia.10.1109/ICETA54173.2021.9726596 ↗
46. Rios, E., Al-Kaswan, A., and Sun, H. (2018, January 27–30). Automating security analysis of infrastructure as code. Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany.
47. Hutchison, D., Lang, C., and Wagner, J. (2022, January 28–29). Automating the risk management framework (RMF) for agile systems. Proceedings of the 2022 Systems and Information Engineering Design Symposium (SIEDS), Charlottesville, VA, USA.
48. Granata, D., Rak, M., and Salzillo, G. Risk analysis automation process in it security for cloud applications. Proceedings of the International Conference on Cloud Computing and Services Science.
49. Rose, S., Borchert, O., Mitchell, S., and Connelly, S. (2020). Zero Trust Architecture, National Institute of Standards and Technology. Technical Report 800-207.10.6028/NIST.SP.800-207 ↗
50. Garbis, J., and Chapman, J.W. (2021). Zero Trust Security: An Enterprise Guide, Springer.10.1007/978-1-4842-6702-8 ↗
51. Gbohunmi, O., Abayomi-Alli, A., Abayomi-Alli, O., and Misra, S. (2025). Zero Trust Architecture: A Systematic Literature Review. arXiv.
52. A survey on zero trust architecture: Challenges and future trends
53. Zero Trust Architecture: Trend and Impacton Information Security10.46338/ijetae0722_15 ↗
54. Simpson, W.R. (2022, January 6–8). Zero trust philosophy versus architecture. Proceedings of the World Congress on Engineering, London, UK.
55. Cybersecurity and Infrastructure Security Agency (CISA) (2023). Zero Trust Maturity Model, Cybersecurity and Infrastructure Security Agency (CISA). v2.
56. AI-driven identity and access management (IAM): The future of zero trust security
57. Gupta, A., Gupta, P., Pandey, U.P., Kushwaha, P., Lohani, B.P., and Bhati, K. (2024, January 9–11). ZTSA: Zero Trust Security Architecture a Comprehensive Survey. Proceedings of the 2024 International Conference on Communication, Computer Sciences and Engineering (IC3SE), Gautam Buddha Nagar, India.10.1109/IC3SE62002.2024.10593067 ↗
58. A continuous authentication protocol without trust authority for zero trust architecture10.23919/JCC.2022.08.015 ↗
59. Strategy for implementing of zero trust architecture10.1109/TR.2023.3345665 ↗
60. Weinberg, A.I., and Cohen, K. (2024). Zero Trust Implementation in the Emerging Technologies Era: Survey. arXiv.10.20517/ces.2024.41 ↗
61. Flexible zero trust architecture for the cybersecurity of industrial IoT infrastructures10.1016/j.adhoc.2024.103414 ↗
62. Towards zero trust security in connected vehicles: A comprehensive survey10.1016/j.cose.2024.104018 ↗
63. Sims, R. (2024). Implementing a Zero Trust Architecture For ICS/SCADA Systems. [Doctoral Dissertation, Dakota State University]. Available online: https://scholar.dsu.edu/theses/445.
64. Exploring Effective Zero Trust Architecture for Defense Cybersecurity: A Study
65. Yao, Q., Wang, Q., Zhang, X., and Fei, J. (2020, January 27–29). Dynamic access control and authorization system based on zero-trust architecture. Proceedings of the 2020 1st International Conference on Control, Robotics and Intelligent System, Xiamen, China.10.1145/3437802.3437824 ↗
66. Applying the principles of zero-trust architecture to protect sensitive and critical data10.1016/S1353-4858(21)00063-5 ↗
67. Schwartz, R. (2024). Informing an Artificial Intelligence Risk Aware Culture with the NIST AI Risk Management Framework, American Bar Association.
68. Research on Improving Cyber Resilience by Integrating the Zero Trust security model with the MITRE ATT&CK matrix10.1109/ACCESS.2024.3417182 ↗
69. Hosney, E.S., Halim, I.T.A., and Yousef, A.H. (2022, January 9–10). An Artificial Intelligence Approach for Deploying Zero Trust Architecture (ZTA). Proceedings of the 2022 5th International Conference on Computing and Informatics (ICCI), New Cairo, Egypt.10.1109/ICCI54321.2022.9756117 ↗
70. Threat modeling for AI/ML systems: The a-z of threat modeling
71. A systematic review on threat modeling for the software development lifecycle
72. Levene, M., Adel, T., Alsuleman, M., George, I., Krishnadas, P., Lines, K., Luo, Y., Smith, I., and Duncan, P. (2024). A Life Cycle for Trustworthy and Safe Artificial Intelligence Systems, National Physical Laboratory. NPL Report MS 57.10.47120/npl.MS57 ↗
73. Hoffman, R., Mueller, J., Klein, G., and Litman, J. (2022). Four Principles of Explainable Artificial Intelligence, National Institute of Standards and Technology. Technical Report NIST.AI.100-1.10.22541/au.162316928.89726114/v1 ↗
74. Improving the local diagnostic explanations of diabetes mellitus with the ensemble of label noise filters10.1016/j.inffus.2025.102928 ↗
75. Akitra (2024). The Ethical Considerations of AI in Cybersecurity: Balancing Security Needs with Algorithmic Bias and Transparency, Akitra. Medium.
76. Lundberg, S.M., and Lee, S.I. (2017, January 4–9). A unified approach to interpreting model predictions. Proceedings of the Advances in Neural Information Processing Systems, Long Beach, CA, USA.
77. A survey of security in zero trust network architectures
78. Next-Gen VM Security: Confidential Computing, Trusted Launch, and Zero Trust at Scale10.56975/tijer.v12i5.158258 ↗