Chapter 8 — Defense and publication plan
Lesson map
Lesson 08 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The defense"]
N2["8.2 Hard questions"]
N3["8.3 The trade-off question"]
N4["8.4 Publication plan"]
N5["8.5 Practitioner engagement"]
N6["8.6 After the defense"]
N7["8.7 Strategy alignment"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The defense"]
N2["8.2 Hard questions"]
N3["8.3 The trade-off question"]
N4["8.4 Publication plan"]
N5["8.5 Practitioner engagement"]
N6["8.6 After the defense"]
N7["8.7 Strategy alignment"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]
[Learning outcomes]
|
v
[8.1 The defense]
|
v
[8.2 Hard questions]
|
v
[8.3 The trade-off question]
|
v
[8.4 Publication plan]
|
v
[8.5 Practitioner engagement]
|
v
[8.6 After the defense]
|
v
[8.7 Strategy alignment]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) prepare for a doctoral defense; (2) anticipate hard questions; (3) plan publication of papers, corpus and code; (4) plan responsible engagement with practitioners.
8.1 The defense
The defense tests whether the candidate can explain, justify and limit the work. Nadia prepares a 40-minute talk: problem, design, results, harm, limits, contributions. Nadia gives the harm finding its own slide immediately after the accuracy result, so examiners see both together. She rehearses with Prof. Grant and with a colleague who plays the external examiner, and keeps backup slides for the follow-up study and the archive test. Nadia ends it with the limits of a synthetic corpus and the planned operational pilot, so the examiners' questions start from what the study cannot show.
8.2 Hard questions
Mock examiners ask: "Why should a SOC trust a synthetic corpus?" "Is a 13-point gain worth the two missed attacks?" "Would results hold for analysts with two months' experience?" "What would falsify your claim?" Nadia answers with evidence and admits where she does not know. Her answers draw on the thesis: the realism review for the synthetic corpus, the failure analysis for the missed attacks, and the participant profile for analyst experience, which she admits her sample does not cover. For the falsification question, she names an operational pilot across at least two SOCs.
8.3 The trade-off question
On the missed attacks, Nadia avoids a simple yes. She explains that the value depends on the SOC's base rates and costs (Axelsson, 2000): if benign triggers consume most analyst time, the gain frees capacity for deeper investigation, but only if guard rails reduce the history-driven misses. She proposes measuring both in an operational pilot. Her answer keeps the two outcomes in one sentence, as the evidence does, and uses the same reasoning about base rates that motivated the project in the first place.
8.4 Publication plan
Paper 1 (experiment and harm) to a security venue; paper 2 (corpus and generator) to a dataset track; a practitioner article for SOC managers. The corpus and code are released with the first paper. Releasing the corpus with the first paper lets reviewers check the experiment's material directly. The dataset paper describes the generator, labels and benign-trigger annotations so others can extend them. The practitioner article leads with the guard-rail recommendation for history fields and states the limits of a synthetic corpus.
8.5 Practitioner engagement
Nadia presents results to Northgate's analysts first, as promised in consent forms, and offers a design note on alert cards. She avoids marketing language. Presenting first to Northgate's analysts keeps the promise made when they consented, and lets them hear about the missed attacks before anyone else. Ruth Okonkwo receives the same aggregate results; no analyst's individual performance is shown. The design note proposes context fields with counter-evidence prompts, matching the thesis's recommendation. Analysts can comment on the note before it goes to Ruth.
8.6 After the defense
Corrections required by examiners are tracked and completed before final submission; the archive is updated with a version tag. Each correction is listed with the examiner's comment, the change and the page, and any change that affects a figure triggers a rerun from the archive. The final version tag is cited in the thesis and the papers, so all outputs point to the same reproducible state of the work. Prof. Grant signs off each correction after checking it against the examiners' list, and the final thesis is deposited at Calder with the archive link.
8.7 Strategy alignment
Her design note references Strategy 8 of Knerler, Parker and Zimmerman (2022), "Leverage tools to support analyst workflow", to connect the research with SOC planning language. The connection lets SOC managers place her recommendation within a plan they may already use, instead of treating it as an isolated research idea. Nadia is careful not to claim that the strategy is validated by her study; she cites it as planning language, while her evidence concerns one design choice within it. The practitioner article cites the same strategy, so SOC managers reading only the article see the same boundary on her claim.
Worked example
At the mock defense, asked "What would falsify your claim?", Nadia answers: "An operational pilot in which enriched cards with guard rails showed no accuracy gain, or a missed-attack rate higher than baseline, across at least two SOCs."
Synthetic case. The defense and plans are invented.
Errors and limits
Publication timelines depend on reviewers; plan for revision cycles.
Exercises
- EX045 — Talk structure. Outline the defense talk. Rubric: 3 = problem, design, results, harm, limits, contributions; 2 = four; 1 = two; 0 = none.
- EX046 — Trade-off answer. How did Nadia answer the gain-versus-misses question? Rubric: 3 = depends on base rates and costs; capacity gain only with guard rails; operational pilot; 2 = partial; 1 = yes/no; 0 = none.
- EX047 — Falsification. What would falsify the claim? Rubric: 3 = operational pilot with no gain or higher misses across two SOCs; 2 = partial; 1 = vague; 0 = none.
- EX048 — Publication outputs. List the planned outputs. Rubric: 3 = experiment paper, corpus paper, practitioner article, open release; 2 = three; 1 = one; 0 = none.
- EX049 — Northgate first. Why present to Northgate's analysts first? Rubric: 3 = promised in consent; respect participants; 2 = partial; 1 = marketing; 0 = none.
- EX050 — Strategy link. Which MITRE strategy did the design note cite, and why? Rubric: 3 = Strategy 8, tools supporting analyst workflow; connects to planning language; 2 = number or name; 1 = wrong; 0 = none.
Synthesis
A strong defense explains, justifies and limits the work; publication and engagement plans honour participants and help practice.
Continue studying — chapter 08 of 08
← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →