Integrating Log-Based Security Analytics in Agile Workflows: A Real-World Experience Report

• URL: http://arxiv.org/abs/2605.00352v1
• Date: Fri, 01 May 2026 02:22:39 GMT
• Title: Integrating Log-Based Security Analytics in Agile Workflows: A Real-World Experience Report
• Abstract summary: This report explores developer perceptions of an effort to integrate log-based fraud detection within an organization, known as the "Red Flag Project"<n>A cross-functional team of eight members (including one author) iterated weekly to implement a proof-of-concept log-based system that alerts stakeholders when accounts exhibit suspicious activity patterns.<n>Our findings highlight key lessons, mitigation techniques, and best practices for embedding security analytics into Agile.
• Score: 0.8680081568962996
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Modern organizations increasingly rely on log data and monitoring signals to protect products against account takeovers and abuse, yet integrating security analytics into fast-moving Agile workflows remains challenging. While it is important to understand how security practices are developed and sustained within Agile, real-world case studies of such integrations remain scarce. This experience report provides insights on developer perceptions of an effort to integrate log-based fraud detection within an organization, known as the "Red Flag Project". A cross-functional team of eight members (including one author) iterated weekly to implement a proof-of-concept log-based system that alerts stakeholders when accounts exhibit suspicious activity patterns. Through semi-structured interviews, we investigate developer perceptions of log-based fraud detection integration-exploring their willingness to adopt the system, challenges encountered, and the overall impact on day-to-day development activities and security perceptions. Our findings highlight key lessons, mitigation techniques, and best practices for embedding security analytics into Agile workflows. We provide insights for practitioners and researchers seeking to incorporate security practices into modern development processes while maintaining both speed and resilience in software delivery.

Related papers

• Automating Static Code Analysis Through CI/CD Pipeline Integration [0.8206562651760948]
  This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process.<n>We propose a novel process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software.<n>We demonstrate the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment.
  arXiv  Detail & Related papers  (2026-09-01T03:53:25Z)
• Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers [3.4345394794323276]
  Large Language Models (LLMs) are increasingly being explored within Security Operation Centers (SOCs) to support text-heavy analytical work.<n>Despite this interest, practitioners describe critical operational concerns, most notably hallucinations and opaque reasoning.<n>We present findings from semi-structured interviews with 20 SOC practitioners spanning frontline analysts, SOC managers, and tool developers.
  arXiv  Detail & Related papers  (2026-08-17T21:37:33Z)
• Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security [57.35851886874902]
  Agentic AI systems execute complex tasks autonomously, but their multi-step trajectories introduce new failure modes that challenge trustworthiness.<n>This survey provides a focused examination of trustworthy agentic AI through two core dimensions that are critical for high-risk deployments.<n>For each dimension, we clarify key concepts, identify where risks emerge along the agent workflow, and summarize stage-targeted mitigation strategies.
  arXiv  Detail & Related papers  (2026-05-17T10:26:37Z)
• Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents [57.49020237126194]
  Large language models (LLMs) have shown promise in assisting cybersecurity tasks, yet existing approaches struggle with automatic vulnerability discovery and exploitation.<n>We propose Co-RedTeam, a security-aware multi-agent framework designed to mirror real-world red-teaming.<n>Co-RedTeam decomposes vulnerability analysis into coordinated discovery and exploitation stages, enabling agents to plan, execute, validate, and refine actions.
  arXiv  Detail & Related papers  (2026-02-02T14:38:45Z)
• ORCA -- An Automated Threat Analysis Pipeline for O-RAN Continuous Development [57.61878484176942]
  Open-Radio Access Network (O-RAN) integrates numerous software components in a cloud-like deployment, opening the radio access network to previously unconsidered security threats.<n>Current vulnerability assessment practices often rely on manual, labor-intensive, and subjective investigations, leading to inconsistencies in the threat analysis.<n>We propose an automated pipeline that leverages Natural Language Processing (NLP) to minimize human intervention and associated biases.
  arXiv  Detail & Related papers  (2026-01-20T07:31:59Z)
• Advancing Embodied Agent Security: From Safety Benchmarks to Input Moderation [52.83870601473094]
  Embodied agents exhibit immense potential across a multitude of domains.<n>Existing research predominantly concentrates on the security of general large language models.<n>This paper introduces a novel input moderation framework, meticulously designed to safeguard embodied agents.
  arXiv  Detail & Related papers  (2025-04-22T08:34:35Z)
• Towards Trustworthy GUI Agents: A Survey [64.6445117343499]
  This survey examines the trustworthiness of GUI agents in five critical dimensions.<n>We identify major challenges such as vulnerability to adversarial attacks, cascading failure modes in sequential decision-making.<n>As GUI agents become more widespread, establishing robust safety standards and responsible development practices is essential.
  arXiv  Detail & Related papers  (2025-03-30T13:26:00Z)
• Integrating DAST in Kanban and CI/CD: A Real World Security Case Study [2.3480418671346164]
  Web application attacks and exploited vulnerabilities are rising.<n>It is increasingly crucial to integrate security into modern development practices.<n>It is challenging to adopt security practices and activities in modern development practices.
  arXiv  Detail & Related papers  (2025-03-27T19:46:05Z)
• AISafetyLab: A Comprehensive Framework for AI Safety Evaluation and Improvement [73.0700818105842]
  We introduce AISafetyLab, a unified framework and toolkit that integrates representative attack, defense, and evaluation methodologies for AI safety.<n> AISafetyLab features an intuitive interface that enables developers to seamlessly apply various techniques.<n>We conduct empirical studies on Vicuna, analyzing different attack and defense strategies to provide valuable insights into their comparative effectiveness.
  arXiv  Detail & Related papers  (2025-02-24T02:11:52Z)
• Leveraging Security Observability to Strengthen Security of Digital Ecosystem Architecture [0.0]
  complexity poses significant challenges for both observability and security in a digital ecosystem.<n>Observability allows organizations to diagnose performance issues and detect anomalies in real time.<n>Security is focused on protecting sensitive data and ensuring service integrity.<n>This paper examines the interconnections between observability and security within digital ecosystem architectures.
  arXiv  Detail & Related papers  (2024-12-07T11:17:29Z)
• Getting Users Smart Quick about Security: Results from 90 Minutes of Using a Persuasive Toolkit for Facilitating Information Security Problem Solving by Non-Professionals [2.4923006485141284]
  A balanced level of user engagement in security is difficult to achieve due to difference of priorities between the business perspective and the security perspective. We have developed a persuasive software toolkit to engage users in structured discussions about security vulnerabilities in their company. In the research reported here we examine how non-professionals perceived security problems through a short-term use of the toolkit.
  arXiv  Detail & Related papers  (2022-09-06T11:37:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.