MENTOR: Maturity Enhancement through Novel Threat-modelling and Operational Resilience

This project focuses on closing the critical gap between cybersecurity theory and daily practice in Flemish software SMEs. Although there is broad consensus that security should be an integral part of the Software Development Lifecycle (SDLC), recent research using the OWASP SAMM framework shows that maturity in the early phases, such as Design and Governance, is alarmingly low. While SMEs are often competent in reactive security measures and operational management, they lack proactive methodologies such as Threat Assessment and structured security education for developers.

The root cause of this lag lies in an economic tension: in an Agile working environment, direct value creation through new features is often prioritized over security efforts. This creates a growing “security debt,” where short-term savings lead to high remediation costs and increased risks in the long term. At the same time, new and upcoming regulations, such as the AI Act, NIS2 legislation, and the Cyber Resilience Act (CRA), require SMEs to demonstrate their cybersecurity maturity in order to maintain access to the B2B market.

To break this deadlock, this project proposes a fundamental “Shift-Left” strategy. Its central objective is the development of an accessible, AI-based Threat Modeling prototype. Inspired by the intent-driven philosophy of “Vibe Coding,” this tool democratizes complex security expertise by proactively suggesting threats based on architectural designs. As a result, security knowledge becomes immediately available to the entire team, transforming Threat Assessment from a time-consuming expert task into a standardized, Agile component of the software development process.