Researchers built an AI system that automatically flags security requirements onto business process diagrams, and it outperforms human analysts at getting the tags right.
The tool takes a BPMN process diagram and a plain-language security requirements document, then produces annotations in the SecBPMN2 format, a security-focused extension of standard BPMN notation. It works in stages: an LLM pulls the relevant security concepts out of the text, a schema-constrained mapping step matches them to valid SecBPMN2 categories, and a rule-based normalization and validation pass cleans up the result. The team tested it on 27 process models spanning multiple industries. Compared to human security analysts doing the same task by hand, the system hit a precision of 0.58 versus 0.29, roughly halving the rate of wrong or misplaced tags, while matching human recall at about 0.50 to 0.52, and it finished the job significantly faster.
Security annotation in process modeling has always been a bottleneck: it needs someone who understands both the business workflow and formal security semantics, a combination that is expensive and rare. Automating even a first draft of that work could make security-by-design modeling realistic for smaller teams and compliance-heavy industries like finance and healthcare that currently skip it or bolt it on late. That said, recall parity with humans means the system still misses roughly half the annotations either way, so it functions as a drafting aid, not a replacement for review.
Doubling precision sounds like a big win until you notice both human and machine are still finding barely half of what's actually there, and a 27-model test set is a modest sample size for a technique aimed at enterprise-scale compliance work.