WSS4J 2.0 comes with streaming (StAX) WS-Security support: http://ws.apache.org/wss4j/streaming.html
We need to verify it's working with the JBossWS integration, test & run benchmarks and possibly turn it on by default.

See also:
http://santuario.apache.org/streaming-xml-security.html
http://coheigea.blogspot.ie/2014/04/apache-santuario-xml-security-for-java_25.html