Are your legacy requirements really covered, or just assumed to be?

Hello, I’ve been working on the same 20+ year old codebase for years, with big spec documents and thousands of tests.

The recurring problem: our client regularly finds requirements that we thought were covered, but actually weren’t.

When we dig into the tests, we often discover:

• requirements partially covered

• tests asserting the wrong thing

• false positives that have been passing for years

With a suite this size, manually verifying requirement-to-test coverage just isn’t realistic.

We’re in a regulated environment (everything on-prem, no cloud tools, open source models only).

Has anyone found tooling that helps analyze spec vs test coverage and surface gaps or weak tests?

Or is this just something everyone struggles with in legacy regulated systems?