arXiv subjects

Alessandra Maciel Paz Milani

Publications and source records attributed to Alessandra Maciel Paz Milani.

4 recordsLinked to original sources

arXiv2026

Towards a Cognitive-Support Tool for Threat Hunters

Cybersecurity increasingly relies on threat hunters to proactively identify adversarial activity, yet the cognitive work underlying threat hunting remains underexplored or insufficiently supported by existing tools. Building on prior studies that examined how threat hunters construct and share mental models during investigations, we derived a set of design propositions to support their cognitive and collaborative work. In this paper, we present the Threat Hunter Board, a prototype tool that operationalizes these design propositions by enabling threat hunters to externalize reasoning, organize investigative leads, and maintain continuity across sessions. Using a design science paradigm, we describe the solution design rationale and artifact development. In addition, we propose six design heuristics that form a solution-evaluation framework for assessing cognitive support in threat hunting tools. An initial evaluation using a cognitive walkthrough provides early evidence of feasibility, while future work will focus on user-based validation with professional threat hunters.

cs.CR↗

arXiv2025

Fuzzy to Clear: Elucidating the Threat Hunter Cognitive Process and Cognitive Support Needs

With security threats increasing in frequency and severity, it is critical that we consider the important role of threat hunters. These highly-trained security professionals learn to see, identify, and intercept security threats. Many recent works and existing tools in cybersecurity are focused on automating the threat hunting process, often overlooking the critical human element. Our study shifts this paradigm by emphasizing a human-centered approach to understanding the lived experiences of threat hunters. By observing threat hunters during hunting sessions and analyzing the rich insights they provide, we seek to advance the understanding of their cognitive processes and the tool support they need. Through an in-depth observational study of threat hunters, we introduce a model of how they build and refine their mental models during threat hunting sessions. We also present 23 themes that provide a foundation to better understand threat hunter needs and suggest five actionable design propositions to enhance the tools that support them. Through these contributions, our work enriches the theoretical understanding of threat hunting and provides practical insights for designing more effective, human-centered cybersecurity tools.

cs.CR↗

arXiv2025

Guiding Principles for Using Mixed Methods Research in Software Engineering

Mixed methods research is often used in software engineering, but researchers outside of the social or human sciences often lack experience when using these designs. This paper provides guiding principles and advice on how to design mixed method research, and to encourage the intentional, rigorous, and innovative application of mixed methods in software engineering. It also presents key properties of core mixed method research designs. Through a number of fictitious but recognizable software engineering research scenarios, we showcase how to choose suitable designs and consider the inevitable trade-offs any design choice leads to. We describe several antipatterns that illustrate what to avoid in mixed method research, and when mixed method research should be considered over other approaches.

cs.SE↗

arXiv2025

Exploring Retrospective Meeting Practices and the Use of Data in Agile Teams

Retrospectives are vital for software development teams to continuously enhance their processes and teamwork. Despite the increasing availability of objective data generated throughout the project and software development processes, many teams do not fully utilize this information in retrospective meetings. Instead, they often rely on subjective data, anecdotal insights and their memory. While some literature underscores the value of data-driven retrospectives, little attention has been given to the role data can play and the challenges of effectively incorporating objective project data into these meetings. To address this gap, we conducted a survey with 19 practitioners on retrospective meeting practices and how their teams gather and use subjective and objective data in their retrospectives. Our findings confirm that although teams routinely collect project data, they seldom employ it systematically during retrospectives. Furthermore, this study provides insights into retrospective practices by exploring barriers to project data utilization, including psychological safety concerns and the disconnect between data collection and meaningful integration of data into retrospective meetings. We close by considering preliminary insights that may help to mitigate these concerns and how future research might build on our paper findings to support the integration of project data into retrospective meetings, fostering a balance between human-centric reflections and data-driven insights.

cs.SE↗