In this study, a framework was developed, based on a literature review, to help managers incorporate cybersecurity risk management in agile development projects. The literature review used predefined codes that were developed by extending previously defined challenges in the literature—for developing secure software in agile projects—to include aspects of agile cybersecurity risk management. Five steps were identified based on the insights gained from how the reviewed literature has addressed each of the challenges: (1) risk collection; (2) risk refinement; (3) risk mitigation; (4) knowledge transfer; and (5) escalation. To assess the appropriateness of the identified steps, and to determine their inclusion or exclusion in the framework, a survey was submitted to 145 software developers using a four-point Likert scale to measure the attitudes towards each step. The resulting framework presented herein serves as a starting point to help managers and developers structure their agile projects in terms of cybersecurity risk management, supporting less overloaded agile processes, stakeholder insights on relevant risks, and increased security assurance.

Cooperative Intelligent Transport Systems (C-ITSs) are an important development for society. C-ITSs enhance road safety, improve traffic efficiency, and promote sustainable transportation through interconnected and intelligent communication between vehicles, infrastructure, and traffic-management systems. Many real-world implementations still consider traditional Public Key Infrastructures (PKI) as the underlying trust model and security control. However, there are challenges with the PKI-based security control from a scalability and revocation perspective. Lately, certificateless cryptography has gained research attention, also in conjunction with C-ITSs, making it a new type of security control to be considered. In this study, we use certificateless cryptography as a candidate to investigate factors affecting decisions (not) to adopt new types of security controls, and study its current gaps, key challenges and possible enablers which can influence the industry. We provide a qualitative study with industry specialists in C-ITSs, combined with a literature analysis of the current state of research in certificateless cryptographic in C-ITS. It was found that only 53% of the current certificateless cryptography literature for C-ITSs in 2022–2023 provide laboratory testing of the protocols, and 0% have testing in real-world settings. However, the trend of research output in the field has been increasing linearly since 2016 with more than eight times as many articles in 2022 compared to 2016. Based on our analysis, using a five-phased Innovation-Decision Model, we found that key reasons affecting adoption are: availability of proof-of-concepts, knowledge beyond current best practices, and a strong buy-in from both stakeholders and standardization bodies.

Decision-making is a central activity in agile software engineering (SE), yet research on how decisions are made and supported in agile contexts remains fragmented across models, methods, roles, and lifecycle stages. While prior studies have examined isolated aspects such as prioritization or planning, a comprehensive synthesis of decision-making as a phenomenon in agile SE is lacking. This systematic literature review addresses this gap by consolidating and structuring existing research on agile decision-making and to identify dominant patterns, gaps, and future research directions. A systematic search was conducted in IEEE Xplore, ACM Digital Library, Scopus, and Web of Science, complemented by backward and forward snowballing, covering publications from 2014 to 2024. In total, 42 studies were included and analyzed using a structured coding scheme covering decision models, methods, actors, lifecycle contexts, and research methodologies. The results reveal a strong concentration of analytical and hybrid decision-making models in planning and requirements activities, while decision-making in coding, testing, and operations remains underexplored. Software developers are the most frequently studied decision-making actors, whereas managers are mainly discussed as external stakeholders rather than active decision-makers within agile workflows. The main contributions of this study are the following: a structured synthesis of agile decision-making research over multiple analytical dimensions, the identification of key research gaps in lifecycle coverage and actor perspectives, and the proposal of a coherent nomenclature for decision-making in agile SE. These contributions provide a foundation for future empirical studies and support the development of more comprehensive theories of decision-making in agile software engineering organizations.

To ensure adequate skill development, but also competitive advantage as a software engineering organization, initiatives in cybersecurity training is one of several important investment decisions to make for management. This study builds upon three case organizations in Sweden and Greece, where managers’ and software developers’ perceptions on trialability and observability effects are analyzed, grounded in the theory of innovation diffusion. Using interviews and a developer-centric survey, both quantitative and qualitative data are collected, and used in combination to support the development of a pre-investment framework for management. The analysis includes thematic analysis, cosine similarity comparison, and, to some extent, sentiment polarity scoring. A pre-investment framework consisting of a process of seven concrete steps is proposed, based on the empirical findings in the study.