# Security Monitoring during Software Development:
## 4 Conclusions and Future Work  
In the present paper, we demonstrated how novel security monitoring mechanisms can be turned into a practical solution properly configured to satisfy custom security needs,  
Figure 16: The overview of the VM4 SEC security monitoring platform utilizing the Microservice-oriented Architectural (MOA) pattern. Figure 17: The Deployment Diagram of the VM4 SEC security monitoring platform. through an industrial case study based on a real software development company. Initially, we conducted an empirical study in order to collect information from the subject company about (i) the current state of their security monitoring activities, (ii) their actual needs for security monitoring during the development process, and (iii) the most suitable security monitoring techniques to be deployed into their pipelines along with the appropriate configuration. This was achieved through a 2-step survey and a focus group conducted with 16 participants from the subject company. Subsequently, we elicited the requirements and defined the main use cases of the envisaged platform, and based on this information we designed its overall architecture. This led to the implementation of the VM4 SEC platform, a security monitoring platform that provides cutting-edge security monitoring mechanisms, tailored to the needs of the company that was used as the subject of our case study. The present paper can be used as an example of how similar novel security monitoring solutions can be made operational in the form of practical tools that are properly configured in order to satisfy the needs of a given company. To the best of our knowledge, the VM4 SEC platform is the only static-analysis-based platform that is available in the literature that provides quantitative security assessment of software products based on cutting-edge security assessment models. It is also the first platform that provides fully operational text-mining-based VPMs, which can be used directly for identifying potentially vulnerable components in software products under development. Finally, an important contribution of the present work is the presentation of a formal approach for building similar security monitoring platforms, i.e., for configuring and adapting novel security monitoring solutions to meet the needs of a specific company and/or application domain, and for integrating them into a unified monitoring platform. Several directions for future work can be identified. First of all, after building the VM4 SEC platform, we are planning to evaluate its usefulness and practicality through its pilot usage by the subject company. More specifically, the VM4 SEC platform will be deployed on the premises of Onelity (i.e., the subject company of the present study) and will be utilized as part of their SDLC to monitor the security level of actual software products that are being developed. After a sufficient period of hands-on experience with the platform, a qualitative evaluation will be conducted, by retrieving feedback from its actual users with respect to its usability, usefulness, and practicality, as well as with respect to how well it reflects their original needs, as expressed during the survey and focus group that were conducted at the beginning of the project and reported in the present paper. Secondly, the potential integration of additional features will be also considered, based on the active feedback that we will receive from its actual users, in order to further improve the usability and practicality of the platform. More specifically, from a technical viewpoint we are planning to extend the VM4 SEC platform, by integrating additional static code analyzers such as SonarQube, Coverity, and Fortify. This will allow the platform to detect additional types of security issues and compute new security metrics.