DevSecOps for Secure Software Development: A Systematic Literature Review of Practices, Benefits, and Adoption Barriers

DevSecOpsUX: An Integrated Framework for Security, Quality Assurance, and User Experience in Continuous Software Delivery

The increasing complexity of modern software systems and the growing demand for continuous software delivery have accelerated the adoption of DevOps practices. However, existing approaches remain largely fragmented, providing limited integration of security, quality assurance (QA), and user experience (UX), thereby creating challenges related to software security, quality, and user acceptance. This study proposes DevSecOpsUX, a reference framework that integrates security, quality assurance, and user experience into a unified model for continuous software delivery. The research follows a mixed-method approach, combining a systematic mapping study of 118 publications with the conceptual design and expert validation of the proposed framework. The framework is structured around four interconnected pillars—SecUX, SecDev, SecQA, and SecOps—and defines thirteen security milestones embedded throughout the software lifecycle that support continuous validation, traceability, and cross-functional integration. The framework was evaluated by thirteen cybersecurity professionals, achieving agreement levels exceeding 90% across the assessed dimensions of relevance, clarity, conceptual coherence, and applicability. The expert evaluation suggests that integrating security, quality assurance, and user experience within a unified lifecycle model may improve the consistency of software validation processes, reduce fragmentation across DevSecOps practices, and enhance user trust in security mechanisms. These findings should be interpreted as an exploratory assessment based on expert judgment rather than evidence of effectiveness in industrial environments. The proposed framework provides an adaptable and measurable reference model for secure and user-centered software delivery while offering practical guidance for organizations seeking to integrate security, quality assurance, and user experience throughout continuous software delivery lifecycles. Future research should focus on empirical validation through industrial case studies and real-world DevSecOps implementations.

Advancing information security maturity models: a systematic analysis of empirical developments (2021–2025)

This research aims to conduct an empirical analysis of the development of Information Security Maturity Models (ISMMs) from 2021 to 2025, focusing on challenges of fragmentation, standardization and the integration of data-driven analytics within information security maturity frameworks. A Systematic Literature Review was undertaken following the PRISMA protocol. Data were synthesized from 25 empirical studies retrieved from Scopus, Web of Science, IEEE Xplore, ScienceDirect and Google Scholar. Thematic and analytical synthesis (QA1–QA6) was conducted to form the basis for comprehensive analysis. Four key themes emerged: 1. Gaps in fragmentation and standardization 2. Adaptability and contextual pliability 3. Assimilation of data-driven intelligence 4. Governance and organizational readiness. The study highlights a transition in contemporary ISMMs from a static compliance-focused approach to a more adaptive and analytical framework. The results of this study indicate that successful implementation of the ISMM will require a balance of architectural approach, between structural standardization and context flexibility. Maturity models are not to be understood as strict compliance tool only, but as a governance structure, which can be adjusted to the current risk profile, degree of digital maturity and organizational resources. This research advances the fragmented theoretical and empirical streams into a composite theory on sustainable cyber resilience. By integrating standardization, data analytics and organizational readiness, it contributes to the development of more sophisticated ISMMs and supports trailblazing studies on AI-driven security maturity models.

IMPLEMENTATION GUIDE OF SOFTWARE DEVELOPMENT BEST PRACTICES BASED ON DEVOPS

Critical Success Factors in Global Software Development: A Systematic Literature Review

Over the last decade, the number of organizations adopting GSD to access a wide range of international talent and reduce their development costs is increasing.. Although, the geographical distance, time-zone, and cultural differences associated with GSD have introduced a number of risks for globally distributed software development teams, continuing to cause a high rate of project failures. To build a more holistic approach and address these challenges, we conducted a Systematic Literature Review (SLR) based on the PRISMA 2020 guidelines. We systematically analyzed a highly filtered set of 19 top-tier, high-impact primary studies published between 2015 and 2025. The objective of this research paper is to perform a formal requirements elicitation, identifying Critical Success Factors (CSFs) to form the architectural foundation of a future GSD project management ecosystem. Our synthesis of the literature reveals seven major CSFs that drive success in globally distributed projects. Crucially, these dimensions were not identified solely based on their frequency of occurrence in the selected studies (appearing in over 50% of the papers), but because the primary sources consistently assigned them high weights and priority rankings using advanced decision-making models. These core dimensions are: Communication and Coordination (100%), Human Resources and Skills (95%), Technology and Infrastructure (74%), Knowledge Management (63%), Management Support and Leadership (58%), Requirements Engineering (58%), and Cost and Time Efficiency (58%).These findings highlight a major paradigm shift within the software industry: socio-technical skills and reliable technology now carry significantly more weight than strict, traditional processes. By integrating these highly validated factors through this requirements elicitation, we outline the fundamental architectural parameters necessary to build a future GSD management ecosystem capable of overcoming the complexities arising from geographical distance.

Integration of Vulnerability Databases into ISMS: A Path to Enhancing Cyber Resilience of Critical Systems

Large Language Models in Cybersecurity: A PRISMA-ScR-Guided Scoping Review of Threats, Defenses, and Emerging Applications

Large Language Models (LLMs) have rapidly evolved into powerful general-purpose systems with advanced natural language processing, code generation, and reasoning capabilities, leading to their increasing adoption in cybersecurity. However, their dual-use nature introduces both significant defensive opportunities and emerging offensive threats. This study presents a PRISMA-ScR-guided scoping review to systematically map the current landscape of LLM applications in cybersecurity, addressing their roles as both threat enablers and defensive tools while identifying key governance challenges and future research directions. Literature published between January 2017 and December 2024 was identified through structured searches of IEEE Xplore, ACM Digital Library, Scopus, Web of Science, and arXiv, supplemented by grey literature and citation snowballing. Studies were screened using predefined inclusion and exclusion criteria, and relevant information was extracted using a standardized data-charting framework followed by thematic narrative synthesis. The review synthesizes evidence from 153 eligible studies, demonstrating that LLMs substantially enhance offensive capabilities such as phishing, malware generation, vulnerability discovery, and adversarial attacks, while simultaneously improving defensive functions including threat detection, vulnerability management, incident response, security automation, and analyst support. The review further identifies critical limitations related to hallucinations, model reliability, privacy, misuse, and governance, highlighting the need for trustworthy deployment frameworks, standardized evaluation benchmarks, and robust regulatory safeguards. By integrating evidence across technical, operational, and governance perspectives, this scoping review provides a comprehensive evidence-based synthesis of the evolving role of LLMs in cybersecurity and outlines priorities for future research and responsible deployment.