# Software Security Analysis in 2030 and Beyond: A Research Roadmap

arXiv: https://arxiv.org/abs/2409.17844 · HTML: https://mlsanity.com/paper/2409.17844/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Sep 2024.

## Built on by (most cited first, 5 of 5)

- [Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks](https://mlsanity.com/paper/2512.09485/) (2025)
- [Reachability Across the NL/PL Boundary: A Taxonomy-Driven Dataflow Model for LLM-Integrated Applications](https://mlsanity.com/paper/2603.28345/) (2026)
- [Empirical Computation: Prompting versus Programming](https://mlsanity.com/paper/2503.10954/) (2025)
- [XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security](https://mlsanity.com/paper/2510.19006/) (2025)
- [Can Open-Source LLM Agents Replace Static Application Security Testing Tools? An Empirical Assessment](https://mlsanity.com/paper/2606.11672/) (2026)

## Abstract (arXiv)

As our lives, our businesses, and indeed our world economy become increasingly reliant on the secure operation of many interconnected software systems, the software engineering research community is faced with unprecedented research challenges, but also with exciting new opportunities. In this roadmap paper, we outline our vision of Software Security Analysis for the software systems of the future. Given the recent advances in generative AI, we need new methods to evaluate and maximize the security of code co-written by machines. As our software systems become increasingly heterogeneous, we need practical approaches that work even if some functions are automatically generated, e.g., by deep neural networks. As software systems depend evermore on the software supply chain, we need tools that scale to an entire ecosystem. What kind of vulnerabilities exist in future systems and how do we detect them? When all the shallow bugs are found, how do we discover vulnerabilities hidden deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless protect our system? To answer these questions, we start our research roadmap with a survey of recent advances in software security, then discuss open challenges and opportunities, and conclude with a long-term perspective for the field.