Requirements engineering digest, week 37 of 2026

1. Ensembling LLMs for AI-Augmented Cybersecurity Software Requirements Generation

   Santiago Perez-Acuna, Yod-Samuel Martín, Juan C. Yelmo

   arXiv (cs.SE) · preprint

   Treats the run-to-run variability of large language models as an asset rather than a defect, aggregating many stochastic generations of security requirements drawn from ISO/IEC 27002:2022 controls with information-retrieval fusion operators, so that valid requirements are ranked ahead of hallucinations.

   Abstract

   Translating high-level controls from security standards into concrete, system-specific requirements is central to cybersecurity requirements engineering. Large language models (LLMs) can accelerate this labor-intensive, recall-sensitive task, but any single run is unreliable: it misses valid safeguards while introducing plausible hallucinations, and outputs shift across runs and models. We reframe this variability as a resource: rather than selecting one output, we study post-generation ensembling, aggregating stochastic runs with information-retrieval data-fusion operators. We propose two strategies: Uniform fusion rewards mere cross-run agreement, whereas Naive-Bayes fusion weights each run by its estimated reliability. We evaluate both over 24 runs from 12 configurations across four model families, generated for ten ISO/IEC 27002:2022 controls and expert-judged against a gold standard of 72 valid requirements. Pooling every run's output recovers all 72 (whereas single configurations recover on average under half) but also 111 hallucinations. Fusion separates the wheat from the chaff, ranking valid requirements well ahead of hallucinations. In the areas under the precision-recall and ROC curves, Uniform fusion alone largely surpasses every original run and configuration by 0.142 and 0.118 over the best configuration. Naive-Bayes weighting adds a further 0.039 and 0.052, reaching 0.864 and 0.869 while attaining useful operating points earlier. Internal validation confirms the stability of these gains: they stay positive in at least 92% of out-of-bag bootstrap resamples and every structured-perturbation sample. Post-generation fusion thus turns apparent noise into a practical asset: a lightweight layer giving analysts broader coverage and a better prioritized review queue, using affordable, below-frontier models alone.

   Source: arxiv.org/abs/2609.10316

2. When Stakeholder-centric Requirements Engineering is Not Enough: An Action Research Study on Legacy System Modernisation

   Ruward S. Karper, Damian A. Tamburri, Alessio Ferrari, Willem-Jan van den Heuvel

   arXiv (cs.SE), to appear at IEEE RE 2026 · accepted

   An action research study in a multinational energy company: stakeholder-centric elicitation produced requirements the stakeholders accepted as understandable and correct, yet left them unable to agree how those requirements mapped onto what the legacy system actually does.

   Abstract

   Legacy system modernisation is a major challenge in digital transformation, especially when organisations depend on long-lived, business-critical systems that are only partly understood. In such context, organisations must define future needs while determining what current systems actually do and which functions to retain, adapt, or replace. Modernisation is therefore not only a technical challenge but also a requirements engineering (RE) problem, shaped by stakeholder perspectives. This study examines how far stakeholder-centric RE can support gap analysis between the system-as-is and the system-to-be in a legacy modernisation context. We conducted an action research study in a multinational energy company engaged in system modernisation. In the study, we applied stakeholder-centric RE practices, including stakeholder identification, semi-structured elicitation interviews, agreement-building through the Delphi method, and prioritisation with the MoSCoW method. The results show that this process was effective in producing requirements stakeholders generally viewed as understandable and correct, but less effective in achieving agreement on how elicited requirements mapped to legacy system functionality. The findings suggest that stakeholder-centric RE is necessary but not sufficient, pointing to the need for uncertainty-aware, iterative, and evidence-based modernisation practices that combine stakeholder perspectives with manual and tool-assisted analysis of legacy systems.

   Source: arxiv.org/abs/2609.07340