## 2 Related Work and Foundational Concepts
### Current Landscape of Secure Development Methodologies and Frameworks  
The modern software development landscape constantly evolves with agile methodologies, cloud-native architectures, and continuous delivery pipelines. While these advancements boost efficiency, they also bring significant security challenges. Traditional security approaches often fall short against today's sophisticated and dynamic cyber threats because they are often implemented too late or through fragmented, manual processes [1; 2]. Finding and fixing vulnerabilities late in the development cycle is costly, causes delays, and leaves systems vulnerable [3]. This situation demands a new approach that integrates security from the start, maintains continuous vigilance, and uses intelligent automation to keep pace with evolving threats. The Secure Software Development Life Cycle (S-SDLC) emerged as a direct response, integrating security into the traditional SDLC [20; 21]. The primary goal of any S-SDLC is to embed security considerations into every stage of development, from requirements gathering to deployment and maintenance. This ensures the final product can withstand evolving threats [22]. To understand where AZTRM-D fits within this context, it is helpful to examine the existing landscape of S-SDLC methodologies and modern security frameworks. Table 1 provides a concise overview of various prominent S-SDLC methods, detailing their key focus areas and core characteristics. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Key Focus/Approach** & **Core Characteristics** \\ \hline Embedded Security in Traditional & This method integrates security deeply into each phase of the traditional SDLC. & It identifies security requirements early, uses threat modeling for design, prioritizes secure coding and static analysis, employs layered testing, and focuses on continuous monitoring and patch management. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of Secure Software Development Life Cycle (S-SDLC) Methodologies. Figure 1: The DevSecOps Life Cycle, integrating security into every phase from planning to feedback. This image was inspired by [19]. While these S-SDLC approaches provide a strong foundation, recent academic and industry work has also focused on building more specific, robust frameworks. Many modern threats target the CI/CD pipeline, exploiting vulnerabilities in open-source dependencies and Infrastructure as Code (IaC), requiring a defense-in-depth strategy beyond basic code scanning [28]. In response, researchers have proposed AI-enhanced models for specific life cycle stages. For example, some have developed machine learning approaches to automate threat modeling within DevSecOps, showing AI's potential to proactively identify design flaws [29]. Concurrently, the Zero Trust (ZT) philosophy has become prominent, with researchers exploring its application beyond network access, extending principles to the supply chain for rigorous verification of all components and suppliers [30]. Others advocate for \"Zero Trust by Design,\" embedding its principles into the very architecture of systems [26]. Furthermore, a significant challenge, is linking security frameworks with non-traditional forecasting models that handle uncertainty. Recent work in areas like grey