SECUTE 2027

About

Following the editions held in 2024 and 2026, the 3rd International Workshop on Software Security Testing (SECUTE) is a forum where academic researchers and industry practitioners can present new ideas on the security testing of software systems and discuss directions and fresh insights. SECUTE aims to build a community that believes in the value of performing dedicated testing activities specifically for security.

SECUTE appeals to the ICST community due to its strong connection to software testing and aims to increase attention to security concerns, which entail a different set of tricky challenges than other testing activities and are often underestimated or neglected.

Scope

Security testing, among other things, involves checking whether specific interactions with the target software affect security-relevant properties such as confidentiality, integrity, and availability. One common type of security test is one that reveals the presence of a security vulnerability in software, possibly localizes it in the source code, and assesses its exploitability and impact.

SECUTE emphasizes introducing innovative methods and techniques to support security testing, such as creating and managing test cases. Of particular interest, SECUTE aims to call for the presentation of novel approaches that make testing actionable during development (i.e., code-level testing) and on testing artifacts beyond source code (e.g., configuration and supply chain components). Nevertheless, SECUTE also welcomes studies on more established security testing approaches, such as vulnerability scanning, fuzzing, and static analysis.

SECUTE accepts any type of study that has a direct connection with security testing, including (but not limited to) solution-oriented studies, benchmarking studies, repository mining, case studies, empirical analyses of how security testing is performed in real-world settings, surveys with industry practitioners, controlled experiments, and literature reviews.

Trivia

SECUTE is pronounced as “seh-KYOOT”

• The “seh” is the same as the first part of “Secure.”
• “KYOOT” is exactly as “cute”.

Where and When

SECUTE 2027 is co-located with ICST 2027 in San Sebastian, Spain.

The date of the workshop will be communicated later.

Call for Papers

The 3rd International Workshop on Software Security Testing (SECUTE) calls for innovative methods and techniques for security testing, particularly those that make testing actionable during development and working on artifacts beyond source code. SECUTE also welcomes studies on more established security testing approaches, such as vulnerability scanning, fuzzing, and static analysis. SECUTE accepts these in the form of original full and ongoing research papers, as well as tool and data papers.

Workshop Scope

The workshop aims to:

• Present novel techniques for creating, managing, and evolving security test cases.
• Evaluate and benchmark existing security testing techniques and approaches.
• Defining key terms, challenges, and opportunities in the field.
• Provide researchers with a comprehensive understanding of the current state of security testing practices.
• Analyzing case studies to understand the experience of software engineers performing security testing activities.
• Encouraging participants to share their experiences and insights regarding challenges faced in dealing with security in real-world software systems.
• Developing a roadmap for future research directions on the matter.

Topics of Interest

SECUTE has the following topics of interest:

• Automated generation of security test cases.
• Maintenance of security test cases.
• Dynamic vulnerability reproduction and exploitation.
• Empirical studies on the evolution of security test cases.
• Benchmarking security testing approaches.
• Creation and curation of datasets of security test cases (and related data).
• The oracle problem in security test cases.
• Documentation, summarization, and comprehension of security test cases.
• Creation and curation of guidelines for security testing.
• Integration of security test cases in CI/CD.
• Security testing for third-party vulnerabilities and software supply chain security.
• Security testing for non-source artifacts, e.g., Infrastructure-as-Code scripts.
• Empirical studies on the effectiveness/benefits of security testing in real-world software systems.
• User studies to understand the experience of software engineers performing security testing.
• Case studies on real-world contexts where security testing is performed.
• Lessons learned and challenges connected to security testing.
• and other topics concerning software security testing.

Submission Categories

SECUTE accepts the following contributions:

• Full research papers (max 8 pages, including references) that present empirical research on topics related to the workshop. Negative results papers are welcome if they can support advice or lessons learned. Papers reporting replications of existing empirical studies are also welcome.
• Ongoing research papers (max 5 pages, including references) that describe ongoing research on topics related to the workshop. The purpose is mostly to communicate new ideas and obtain early feedback from the workshop community. An ongoing research paper must describe the idea and the proposed evaluation and assessment strategy, possibly (but not necessarily) with some preliminary results.
• Tool and data papers (max 5 pages, including references) that present usable tools that support security testing and datasets concerning security tests.

SECUTE welcomes studies with negative findings or nonsignificant results, as well as thought-provoking ideas.

Review Criteria

Papers will undergo a thorough double anonymous peer-review process involving three program committee members.

Papers will be evaluated according to the following criteria:

• Significance: The extent to which the paper’s contributions can impact the field of software engineering, and under which assumptions (if any).
• Soundness: The extent to which the paper’s contributions and/or innovations address its research questions and are supported by rigorous application of appropriate research methods.
• Novelty: The extent to which the contributions are sufficiently original with respect to the state-of-the-art.
• Verifiability and Transparency: The extent to which the paper includes sufficient information to understand how an innovation works; how data was obtained, analyzed, and interpreted; and how the paper supports independent verification or replication of the paper’s claimed contributions.
• Presentation: The extent to which the paper’s quality meets the academic writing standards, including clear descriptions, adequate use of the English language, absence of major ambiguity, clearly readable figures and tables, and adherence to the formatting instructions provided above.

All papers must include a “Data Availability Statement” placed after Conclusions in the paper submission, within the page limit, declaring where artifacts (reproduction package, appendices, etc.) can be found. During the peer-review period, the artifacts should be stored in publicly accessible, anonymized repositories so reviewers can inspect them. At this stage, there is no need to reserve a DOI. After acceptance, the artifacts must have a DOI, and the link must be updated. To increase the paper’s verifiability and transparency, it is recommended to provide all data and scripts used in the research. However, if some data cannot be released, there must be a clear justification.

Submission Format

The submission format follows the main conference ICST 2027.

In short, papers must:

• conform to the two-column IEEE conference publication format;
• adhere to the IEEE Conference Proceedings Formatting Guidelines.

And authors must comply with:

• the IEEE Plagiarism Guidelines;
• the IEEE Policy on Authorship.

Submissions and Presentation

Submissions that meet the above requirements can be made via the system provided by the main conference to workshops (to be announced).

Accepted papers will be invited to host a technical talk to present and discuss their work. At least one author must be registered to SECUTE 2027 and present the paper. The workshop will be in-person, and remote participation is not planned.

Papers presented at the workshop will be published in the proceedings through the IEEE digital library, in line with the main conference’s indication.