Chapter 8 — Defense and publication plan

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 The defense"]
  N2["8.2 Policy implications"]
  N3["8.3 Publication plan"]
  N4["8.4 Post-doctoral agenda"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 The defense"]
  N2["8.2 Policy implications"]
  N3["8.3 Publication plan"]
  N4["8.4 Post-doctoral agenda"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]

[Learning outcomes]
    |
    v
[8.1 The defense]
    |
    v
[8.2 Policy implications]
    |
    v
[8.3 Publication plan]
    |
    v
[8.4 Post-doctoral agenda]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) defend the thesis against expert questions; (2) plan publications for academic and practitioner audiences; (3) set a post-doctoral research agenda.

8.1 The defense

At her defense, examiners ask hard questions. One asks whether reporting could rise because staff fear being caught by simulations. Mireille points to the burden survey and to the policy of no individual consequences, and admits she cannot rule out some anxiety-driven reporting. Another asks why she did not measure breaches; she explains the time and data that would require. Examiners value clear answers that separate what her evidence shows from what it cannot show. She prepares for the defense by rehearsing with two colleagues who play sceptical examiners and question every limitation in turn.

8.2 Policy implications

Examiners ask what councils should do. Mireille recommends that organisations evaluate awareness programmes by timely reporting rather than click rates alone, rate simulation difficulty, never punish individuals for clicking, and invest in making reporting easy. She links these to NIST SP 800-50 Rev. 1, which calls for evaluating learning programmes, and to the ENISA culture guidelines. She adds that policy should require ethical review of simulations, since poorly designed ones can damage trust between staff and security teams. Each recommendation is tied to a specific result in the thesis.

8.3 Publication plan

Mireille plans three outputs: a journal article on the stepped study, a methods paper on the measurement protocol, and a practitioner briefing for public-sector security teams. Each has a target venue and a draft timeline. The archive's persistent identifier is cited in all three. She plans to share the practitioner briefing through a public-sector network, so that the results reach organisations which rarely read academic journals. She also plans to present the work at a public-sector security conference and to write a plain-language summary for Vantor staff who took part, thanking them and explaining what their participation showed.

8.4 Post-doctoral agenda

Mireille's next research question follows from her limits: a factorial study to separate the report button from feedback, and a longer study linking reporting to incident response time. She applies for funding with Vantor and Brenholt as partners. Prof. Aalto's final advice is to keep the discipline that made the thesis credible: pre-registration, ethical simulation design and independent validation. Her defense passes with minor corrections. She also plans to mentor a master's student who will help with the factorial study, and she schedules a meeting with both councils to agree what data each can share under the new project.

Worked example

Mireille answers examiners with clear limits, draws ethical policy recommendations, plans three publications and sets a factorial follow-up agenda.

Synthetic case. The defense and plans are synthetic; SP 800-50 Rev. 1 and ENISA (2019) are real.

Errors and limits

Policy recommendations generalise beyond one or two councils. Funding may not follow.

Exercises

• EX045 — Fear question. How did Mireille answer the fear-driven reporting question?
  Show marking criteria

  Rubric: 3 = burden survey and no-consequence policy, admitting some anxiety cannot be ruled out;; 2 = partly;; 1 = denied;; 0 = none.
• EX046 — Evaluation advice. What should organisations evaluate instead of click rates alone?
  Show marking criteria

  Rubric: 3 = timely reporting;; 2 = reporting;; 1 = completion;; 0 = none.
• EX047 — Simulation ethics policy. Why should policy require ethical review of simulations?
  Show marking criteria

  Rubric: 3 = poorly designed simulations damage trust;; 2 = trust;; 1 = vague;; 0 = none.
• EX048 — Three outputs. Which three outputs does she plan?
  Show marking criteria

  Rubric: 3 = journal article, methods paper and practitioner briefing;; 2 = two;; 1 = vague;; 0 = none.
• EX049 — Next study. What is her next research question?
  Show marking criteria

  Rubric: 3 = a factorial study separating button from feedback, and linking reporting to response time;; 2 = factorial;; 1 = vague;; 0 = none.
• EX050 — Defense outcome. What was the defense outcome?
  Show marking criteria

  Rubric: 3 = passed with minor corrections;; 2 = passed;; 1 = failed;; 0 = none.

Synthesis

A doctoral defense separates evidence from speculation, turns findings into ethical policy and sets the next research questions.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →