## 2 Related Work and Foundational Concepts
### Current Landscape of Secure Development Methodologies and Frameworks
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Key Focus/Approach** & **Core Characteristics** \\ \hline \multirow{4}{*}{Early and Continuous Integration [21]} & This approach emphasizes early and continuous security integration through stakeholder involvement and education. & It aligns security requirements with business objectives, involves security experts and stakeholders, fosters a culture of security awareness, and integrates automated, continuous security testing throughout all phases. \\ \hline \multirow{4}{*}{Agile-Adapted Security [5]} & This method integrates security into Agile methodologies, making it well-suited for dynamic and iterative development. & It embeds security activities like threat modeling and reviews directly into Agile sprints. Security testing is performed iteratively, and a “security backlog” helps prioritize and manage tasks. \\ \hline \multirow{4}{*}{Common Criteria (CC) Certification Aligned [23]} & This approach is tailored to meet the rigorous requirements of CC certification. & It emphasizes aligning with specific CC security controls and extensive documentation. Formal risk management is key, requiring detailed risk assessments (e.g., ISO/IEC 27005) to systematically identify and mitigate threats. \\ \hline \multirow{4}{*}{DevSecOps Transformation [6; 24]} & This method transforms the DevOps process into a holistic DevSecOps approach, ensuring security is a shared responsibility across all stages. & Key features include automated security integration into the CI/CD pipeline, fostering a collaborative culture between development, operations, and security teams, and using continuous monitoring with real-time feedback for rapid remediation. \\ \hline \multirow{4}{*}{Categorized Software Security Strategies [25]} & This method is based on a comprehensive study that categorized software security strategies into five main approaches. & These include Secure Requirements Modeling: Vulnerability Identification via static and dynamic analysis; Software Security-Focus Processes using frameworks like Microsoft SDL; Extended UML-Based Secure Modeling; and Non-UML-Based Secure Modeling. \\ \hline \multirow{4}{*}{Proposed AZTRM-D Methodology (This Work) [26; 27]} & This is a unified, AI-augmented process that builds upon existing S-SDLC methods. & It integrates proactive DevSecOps, structured NIST RMF, and stringent Zero Trust (ZT) access controls. A unique aspect is its direct application of ZT principles to the AI systems within the SDLC, ensuring automation tools are continuously verified. This creates a more resilient security framework. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: \(Cont\). system modeling offers new ways to forecast outcomes in complex, data-sparse environments, which is highly relevant to early-stage risk assessment. For instance, studies on fractional grey system models for predicting environmental emissions demonstrate methodologies for creating accurate predictive models under conditions of high uncertainty [31]. Including this perspective strengthens the theoretical foundation of AZTRM-D's predictive capabilities, connecting its AI-driven risk analysis to broader interdisciplinary paradigms. While these approaches advance software security, they often focus on specific domains. Other researchers have proposed structured AI-driven security models, such as the ANN-ISM paradigm for software development, which provides a valuable reference point for formalizing security processes [32]. However, a gap remains for a comprehensive framework that unifies the agile methodology of DevSecOps, the rigorous validation of Zero Trust, and the structured governance of a formal Risk Management Framework (RMF) into a single, cohesive life cycle, all orchestrated by AI. Table 2 compares these approaches and highlights AZTRM-D's unique contribution.