Enhancing Security Requirements Coverage via RAG and Automated Feedback Loops

The integration of Large Language Models (LLMs) into Software Engineering offers efficiency but may also introduce significant risks. In Security Requirements Engineering (SRE), generic LLMs frequently exhibit omission errors-failing to identify necessary security constraints-and hallucinations. While Retrieval-Augmented Generation (RAG) mitigates factual errors, standard implementations rely on semantic similarity, creating a bottleneck that overlooks structurally necessary but semantically distinct security categories. To address this, we propose a specialized RAG framework designed as an automated Quality Assurance mechanism. Our approach integrates a curated OWASP Knowledge Base with a novel two-stage generation pipeline. Unlike single-shot RAG, our system incorporates a deterministic threshold-based feedback loop: it statically analyzes the initial output's coverage against the security taxonomy and triggers an adaptive compensatory generation to populate under-represented categories. We evaluated the framework on UniClass, a web application case study, across repeated executions. Empirical results demonstrate that the pipeline achieves a stable Mean Coverage of 72% across relevant security categories with a high Applicability of 8 1 %, as verified by one project developer. By enforcing structural completeness before implementation, our approach serves as a critical QA guardrail for secure AI-driven development.