The human the system was designed for
Every security system carries an implicit portrait of the person who will use it. That person is attentive. They are consistent. At the moment a decision has to be made — click or do not click, trust this certificate or do not, import this key or give up — they are rational and unhurried.
I have never met that person. The human who actually shows up is at the end of a long session. Their perceptual system has hard physical limits they cannot introspect on. They are holding a tool whose failure modes are invisible, so they cannot tell whether the last thing they did worked. The distance between the designed human and the real one is not a training deficit to be lectured away. It is a property of the system, it can be measured, and an attacker can use it.
My research measures that distance directly. I instrument the person rather than only the system — synchronized EEG, eye tracking, behavioral response, validated survey instruments — and then ask what a defense would look like if it were built for the human who actually arrives.
Three commitments run through all of it. Measure, do not assume: claims about security behavior are routinely built on self-report and click rates, and the failures that interest me happen below the level a questionnaire can reach. Report the ceiling honestly, including when it is a null: two of my three dissertation studies returned results less convenient than the hypotheses that motivated them, and saying so plainly is worth more to the field than the stronger claim. Study the tools people actually fail with: not hypothetical interfaces, but the software in front of them.
The students who could not send an encrypted email
The work started with a population I could not explain away.
End-to-end email encryption has been available in mainstream clients for years, and adoption remains negligible. The standard account of why is user apathy — people do not care enough to bother. I had access to a group where that account cannot hold: graduate and undergraduate cybersecurity students at Texas A&M, required to exchange PGP-encrypted mail as coursework, motivated by their grades, technically proficient, and handed step-by-step instructions.
They failed anyway. What made it research rather than an anecdote was that the failures clustered.
Across four semesters I built a corpus out of what the course was already producing: student support emails, teaching-assistant office-hour logs, troubleshooting exchanges. The breakages were specific and reproducible. Key import failed on a version mismatch between GnuPG and Thunderbird’s integrated OpenPGP. A menu-bar discrepancy on macOS meant the documented path simply did not exist on the machine in front of the student. One extra newline in a pasted key block aborted the import silently. And most consequentially of all: there was no success confirmation. A student who had succeeded and a student who had failed were looking at the same screen.
The methodological turn here is the population argument. Because this cohort is strictly more capable and more motivated than a general user, their failure rate is a conservative lower bound on what encrypted email costs everyone else. The usual weakness of a convenience sample becomes the design’s central strength. That work was published at IEEE PST 2025; a journal extension is under review, adding transformer-based analysis of the student corpus and its relationship to public support-forum discussion. The point of that layer is to separate failure local to one course, one operating-system image, one semester, from failure that recurs in the wild — the distinction that makes the findings actionable for the people maintaining the tools rather than merely descriptive.
Asking whether the eye knows what the viewer does not
Deepfake research is dominated by automated detection, and where humans appear at all they are usually reduced to an accuracy figure. But there is a body of work in cognitive neuroscience suggesting the visual system registers manipulations that conscious report never reaches — sensitivity without access. If that held for synthetic video, it would justify an entirely different class of defense: one that reads the viewer instead of the file.
We tested it. Twenty-five participants watched real, deepfake, and look-alike video under three familiarity conditions — well-known public figures, faces they had been briefly familiarized with, and impersonators — while we recorded EEG and gaze alongside their behavioral judgments.
The implicit channel returned a null. Participants told real from fake well above chance, and no reliable differential neurophysiological or gaze signature emerged. The framing I use, because it is the one the data support, is behaviorally detectable, neurophysiologically silent.
I want to be exact about what that does and does not establish, because this study taught me more than any other. Our instrument was a small number of bipolar derivations feeding a proprietary classifier, plus coarse band power computed over whole clips. The neuroscience result that motivated the hypothesis came from multivariate decoding of high-density EEG. A null drawn from aggregate engagement estimates is not evidence against a multivariate decoding effect; they are different measurements of different things. So the honest conclusion is narrower than the brain cannot tell. It is that the class of low-density, real-time-viable instrumentation a deployable system could actually use does not recover a usable signal — which is arguably the more operationally relevant claim anyway, since a defense requiring laboratory-grade EEG and per-participant calibration raises the attacker’s cost not at all.
What happens when the participant is in the state attackers find them in
Security decisions are not made at rest. They are made at the end of a long day, mid-incident, after hours of sustained attention. Nearly every phishing study, however, measures a rested participant who has just sat down.
Twenty-six participants completed a phishing discrimination task, then an extended incongruent Stroop task as a fatigue induction, then a second discrimination block — with EEG, eye tracking, behavioral response, and the Cyber Operations Stress Survey recorded throughout.
Discrimination collapsed. Reconstructed through signal detection theory, sensitivity fell from roughly d′ = 2.5 to d′ = 0.3. And alongside it — this is the part that matters operationally — the decision criterion shifted substantially toward judging pages authentic. Those are two distinct failures with different defensive implications. The machinery for telling real from fake degraded, and the policy governing what gets accepted drifted toward trust. A fatigued user does not simply become worse at the task. They become more willing to believe.
The criterion shift is the finding I would build on, because it points somewhere specific: a fatigue-aware defense should not try to restore accuracy. It should counteract the drift toward acceptance, raising friction on trust-granting actions in particular rather than on everything uniformly.
The study carries a limitation I state in the paper and would state in any talk. There is no rest-arm control, so induced fatigue is not fully separable from time-on-task or from motivational disengagement. The design does randomize stimulus allocation per participant across blocks, which rules out any confound of stimulus difficulty, but the temporal confound is real and unresolved. Fixing it is the first study I would run.
When the bottleneck is human judgment
A different thread, from a different frustration. Systematization-of-knowledge work has a scaling problem: rating fifty papers against seven criteria is thousands of individual judgments, and human effort becomes the binding constraint on how much of a field you can actually look at. I have worked on treating that as an instrumentation problem rather than an endurance one.
The architecture, developed across two studies — one on phishing website detection, one on fuzzing of AI models — works like this. A published codebook fixes what each rating level means. Two evaluator language models independently assign ratings, each required to cite evidence from the source text. A third model arbitrates where they disagree. Human experts then verify and correct every label. Agreement between model and expert labels ran near 90% in both studies, and we report it as a result, because the method has no credibility without it.
The substantive findings converged on the same uncomfortable shape. In phishing detection, no paper in the corpus satisfied all seven functional and security requirements — and papers reporting 80–90% accuracy outperformed those reporting 99–100% on concept drift and adversarial robustness. The leaderboard, in other words, is partly measuring how easy the evaluation was. In the fuzzing work, the same pattern appeared, along with an empirical re-run showing that a substantial fraction of one method’s reported adversarial inputs did not survive image serialization — meaning part of that literature may be reporting floating-point artifacts as faults.
The phishing systematization was accepted at USENIX Security 2026. I am extending the method to post-quantum cryptography, where the problem is different in character: the field oscillates between hype and complacency, and what is missing is a taxonomy tied to actual deployment evidence.
The methods I now insist on
Two of the three studies above came back less convenient than the hypotheses that produced them, and that experience has changed how I design work rather than merely how I write it up.
Human neurophysiology in security lives at twenty to thirty participants with thousands of features, which is precisely the regime where standard practice goes quietly wrong. So: participant-wise rather than trial-wise splits, permutation testing against a properly constructed null, leave-one-participant-out cross-validation, and confidence intervals on every reported classification figure. Where a null is load-bearing — where the argument depends on the absence of an effect — equivalence testing or Bayes factors, planned in advance, so that a null is interpretable rather than merely disappointing.
Signal detection analysis in place of raw accuracy, for the reason the fatigue study made vivid: accuracy conflates sensitivity with decision criterion, and against an unbalanced stimulus pool it is actively misleading. Decomposing into d′ and criterion, computed per participant rather than from group means, is now standard in my analyses.
And negative controls for anything stated in embedding space. Sentence-embedding spaces are anisotropic; unrelated English corpora routinely sit at cosine similarities that look impressive in isolation. A similarity score without a matched off-topic control corpus is uninterpretable. That is a correction I applied to my own work and now treat as a design requirement rather than a robustness check.
I mention these because a statement full of positive findings tells you what someone found. What they do after a null tells you how they work.
From findings to systems
Fatigue-aware defenses. The criterion shift is the most actionable result I have and it is currently a finding rather than a system. First, establish the causal claim properly: replicate with a counterbalanced rest-arm control, separating induced fatigue from time-on-task. That study is publishable on its own and is a natural first project for a doctoral student. Then estimate the dose-response curve, because fatigue is not binary and the design question is where degradation begins — and in particular whether criterion drift onsets before sensitivity loss, since if it does, the observable warning sign is a change in what people accept rather than in how often they are right. Then build the closed loop: a system that estimates cognitive state from lightweight signals and modulates friction on trust-granting actions specifically. The deepfake null constrains this usefully. It must work without laboratory EEG or per-participant calibration, or it is not deployable.
Usable security beyond encrypted email. The PGP study established a transferable method: instrument a population that should succeed and treat their failures as a lower bound. The same design applies to passkey and WebAuthn enrollment and recovery, hardware-token workflows, encrypted backup, and post-quantum migration tooling as it reaches practitioners. This direction needs no specialized hardware, generates data from ordinary instructional activity, produces results on a semester timescale, and gives undergraduates a real role rather than someone else’s script to run.
Evaluation as infrastructure. Everything I have published using model-assisted systematization reports agreement as a single percentage, and that is not enough. The open questions are what kinds of judgment models systematically get wrong, whether disagreement patterns predict which papers need human attention, and whether the arbitration step adds information or merely launders variance. Answering those turns a workflow into a methodology.
Post-quantum readiness as an organizational problem. The cryptographic transition is treated as an algorithms question and is substantially a human one. Harvest-now-decrypt-later means the decision-relevant question is not when a cryptographically relevant quantum computer will exist, but how long this particular data must stay confidential and who in the organization knows that. My current survey work builds the technical taxonomy; the natural continuation is empirical — what practitioners believe about the timeline, how migration decisions actually get made, and where the tooling fails the people asked to use it. Which returns directly to where this started.
Where the research and the teaching meet
I have supervised five undergraduate researchers and senior projects across two institutions. Two of those former mentees are continuing collaborators and coauthors on the ongoing post-quantum survey. That is the model I want to keep: a student project that produces something real, and a working relationship that outlasts the semester.
My classroom has also been a research site in the most literal sense. The encrypted-email work is a multi-semester study of how students fail with security tooling, generated by teaching and published in a security venue. This is not a research program that tolerates a teaching load; one of its three dissertation chapters exists because of one.
Human-subjects work is itself a training asset. Protocol design, ethics review, informed consent, and data governance are exactly the skills students need and rarely encounter before graduate school. I design studies so that undergraduates can hold genuine roles inside them — collecting, coding, and analyzing real artifacts.
On funding: I contributed as a graduate research assistant to federally funded programs during the doctorate, including work supported by the Air Force Office of Scientific Research and the National Science Foundation. Those awards are held by the principal investigator.