Now that my dissertation is complete, I offer my perspective on the process and some advice for prospective PhD candidates.

For my dissertation, I'm arguing that we should be able to formally model and analyze human mental models to find unanticipated problems in computer security. But what does that mean and why does it matter?