Usable Security: Bridging Research and Industry Practices

Usable Security: Bridging Research and Industry Practices

Speakers: Julia (PhD in Computer Science, ETH Zurich; 9 years at Google; 4 years at Snowflake as Senior Engineering Manager)

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=-pDn4-nQjyA

Overview

Julia, who completed her PhD in usable security at ETH Zurich and has spent 13 years in industry at Google and Snowflake, delivers a talk that bridges academic usable security research with practical industry application. The talk spans the history of foundational usable security research, a detailed walkthrough of her own award-winning study comparing expert and non-expert security behaviors, practical techniques for running user studies in enterprise settings, and a forward-looking analysis of how AI is reshaping usable security challenges.

The talk earned particular credibility through Julia's receipt of an impact award from SOUPS (Symposium on Usable Privacy and Security) in 2024 for her research on usable security advice. Her central message is that the principles of usable security -- design things secure by default, align with users' mental models, provide transparency, involve real users in testing -- remain essential in the AI era but must adapt to a world where users delegate to AI agents and the pace of decision-making has exploded.

This is a rare talk that connects academic rigor with practical engineering reality, offering both the methodology for how to do usable security research and the operational lessons from applying it at Google and Snowflake.

Background

▶ Watch: Introduction: I hate passwords and I want to make security usable (0:00)

Julia frames usable security as an interdisciplinary field combining human-computer interaction (HCI) and security engineering, built on the principle that secure systems must also be user-friendly -- otherwise users will bypass or misuse them. She references several foundational papers:

• "Why Johnny Can't Encrypt" by Alma Whitten (1999), which demonstrated through user studies that PGP's interface was fundamentally unusable, challenging the prevailing assumption that users were simply at fault for not encrypting their email.
• "Users Are Not the Enemy", which shifted the paradigm from blaming users for security failures to examining how system design fails users.
• Professor Lorrie Cranor's password research at Carnegie Mellon, including her analysis of leaked password databases that she visualized as a "security blanket" where the most common passwords appeared largest -- an artistic yet powerful way to convey risk to non-technical users.
• Cranor's metaphor of security warnings as "warning signs on pavement": if the underlying system were secure by default, pedestrians (users) could walk through safely without warnings. Warnings exist because engineers could not fix the underlying problems and instead shifted the decision to users.

Key Findings

▶ Watch: Usable security principles: secure by default, mental models, transparency (10:00)

The centerpiece study surveyed 231 security experts and a population of non-experts via Amazon Mechanical Turk to compare their security behaviors and perceptions. Key findings:

Expert vs. Non-Expert Behavior Divergence: Experts prioritized keeping systems up to date, using unique passwords, and enabling two-factor authentication. Non-experts prioritized using antivirus, changing passwords frequently, and visiting only known websites. The gap between these priorities represents a massive opportunity for security education alignment.

Password Manager Adoption Gap: Experts used password managers at significantly higher rates than non-experts. Non-experts resorted to remembering passwords, with one respondent saying "no one can hack my mind" -- while likely reusing the same password everywhere. Others distrusted password managers because "no other application seems to be safe."

Mental Models Drive Behavior: Even when a security practice is objectively superior (password managers), if it does not match how non-technical users think about security, they will not adopt it. This finding has direct implications for how security teams communicate about and deploy security tools.

Forced Password Changes Reduce Security: Drawing on Lorrie Cranor's research, the study reinforced that forcing password changes does not result in stronger security outcomes. Users cope by creating predictable variations (adding "1", changing a single character), which attackers can easily guess if they know the previous password.

Passkeys as the Future: While not part of the original study (passkeys did not exist at the time), Julia identifies passkeys as the development that would most significantly change the results if the study were repeated today.

Technical Deep Dive

▶ Watch: Results: expert behaviors vs non-expert behaviors divergence (22:00)

Julia provides a detailed walkthrough of usable security research methodologies:

• Exploratory Studies (Qualitative): Open-ended interviews to discover unknown unknowns about how users think about and use security systems. Julia used these at security conferences to gather initial expert security behaviors.
• Surveys (Quantitative): Structured questionnaires to quantify trends, compare demographics, and validate findings at scale. Amazon Mechanical Turk provides rapid turnaround (1-2 days).
• Interface/Usability Testing: Task-based studies where users attempt specific actions (authenticate with biometrics, set up access controls) while observers note pain points.
• Longitudinal Diary Studies: Extended observation of user behavior over time, which Julia argues becomes increasingly important for AI systems where agent behavior changes and adapts.
• A/B Testing: Particularly valuable in industry, where different interface versions can be tested against real user behavior to determine which security warnings or explanations work better.

The industry case study involves building an internal access group management system at Snowflake. Julia's team faced a launch decision: deploy with only a CLI interface or wait months for a UI. Against her expectation as a manager that users would prefer the GitHub UI for adding team members, usability testing with engineers revealed they preferred the CLI because it guaranteed correct formatting -- "I'm sure the CLI is doing the right thing" versus uncertainty about manual PR edits. Another user bypassed the documentation entirely and asked an AI assistant for instructions, which gave incorrect answers. This highlighted a new usability consideration: AI tools as an intermediary between documentation and users.

Julia also references the NEAT framework for security warnings: warnings should be Necessary, Explained, Actionable, and Tested. She suggests it may be time to teach AI agents these principles directly.

Demo / Proof of Concept

▶ Watch: No one can hack my mind: why users reject password managers (24:30)

No live demo was presented. The talk uses the Snowflake access group management system as a practical case study, including the CLI vs. UI usability testing results and the unexpected AI documentation bypass scenario.

Defensive Implications

▶ Watch: AI era: exploding access control problem and warning fatigue (42:00)

The defensive implications span both organizational practices and system design:

• Secure by default eliminates the need for warnings. Invest engineering effort in securing the underlying system rather than asking users to make security decisions.
• Run your own usability studies. Even five interviews can reveal critical pain points. Record sessions, use AI to synthesize findings, and iterate quickly.
• Apply the NEAT framework to every security warning: is it Necessary, Explained, Actionable, and Tested?
• Account for AI as a user intermediary. Users will ask AI assistants for instructions instead of reading documentation. Ensure AI tools give correct security guidance.
• Passkeys over passwords. The expert-vs-non-expert behavior gap around passwords is best resolved by eliminating passwords entirely through passkey adoption.
• Do not force password changes. Research consistently shows this produces weaker security outcomes through predictable password mutations.
• In the AI era, design for human-AI delegation. Users cannot review every AI agent prompt or action. Risk-based surfacing of security decisions -- where only high-risk actions require human approval -- is essential for scaling human oversight.
• Consider longitudinal studies for AI-integrated systems where behavior and agent responses change over time.

Key Takeaways

• Usable security is not at odds with strong security -- good design makes systems both secure by default and easy to use
• The expert/non-expert behavior gap (experts: update systems, use 2FA, use password managers; non-experts: use antivirus, change passwords, visit only known sites) reveals where security education must improve
• Mental models drive security behavior -- if users do not understand why a practice is secure, they will not adopt it regardless of expert recommendation
• Forced password changes produce weaker security outcomes; passkeys are the most promising replacement
• The NEAT framework (Necessary, Explained, Actionable, Tested) should govern every security warning
• AI agents create new usable security challenges: warning fatigue from access control decisions, AI giving incorrect security instructions, and the need for risk-based human oversight
• Even lightweight usability testing (five interviews) reveals critical design flaws and should be standard practice for security tool development

About the Speaker(s)

Julia holds a PhD in computer science from ETH Zurich with a focus on usable security. She received an impact award from SOUPS (Symposium on Usable Privacy and Security) in 2024 for her research on usable security advice. She spent nine years at Google working on security systems (end-user-facing, enterprise, and internal infrastructure) and four years at Snowflake as a senior engineering manager, consistently applying usable security principles to industry practice.