When specifying a system, security and privacy need to be addressed as early as possible, yet stakeholders find doing so difficult in the face of conflicting priorities. When these concerns are addressed, we discover how intrinsically difficult specifying usable security and privacy can be towards meeting business and developmental needs, and the subsequent blurred distinction between requirements and security and privacy concepts.

The theme of this year of Evolving Security and Privacy Requirements Engineering (ESPRE) workshop will be Large Language Models (LLMs) and their applications. In the last few years, Large Language Models (LLMs) have redefined many paradigms. The potential of LLMs lies in their abilities to manipulate text and knowledge, with the concrete chance to impact in many aspects of requirement engineering heavily. This is especially true for security and privacy requirements, where LLMs will greatly improve aspects such as correctness or coverage. On the other side of the coin, LLMs must comply with and fulfill security and privacy requirements, too, yet the shape of these requirements and their enforcement have only marginally been explored.

The ESPRE workshop provides a multi-disciplinary one-day workshop, bringing together practitioners and researchers from across the world interested in evolving security and privacy requirements engineering practice.

The workshop will include an invited keynote talk, paper presentations and discussions, and a facilitated roadmap discussion session towards future Security and Privacy Requirements Engineering activities.