The computer security research community has long debated ethics in research, and how to report it. Our prior research finds that, among others problems, space in a research paper, and guidance on how to write about ethics, are pain points for authors [1]. For the top-tier computer security conference, USENIX Security, a mandatory ethics section was added for all papers submitted to cycles of the 2025 conference, granting authors a combined extra page for ethical deliberations, and giving instructions on what authors may want to discuss in an ethics section. We analyze these new ethics sections for all 425 papers published at USENIX Security 2025 that were publicly accessible in January 2026. We find that 80% of the papers utilize the space for discussing ethics, with vulnerability disclosures, beneficence or harms vs. benefits discussions, as well as consent being discussed the most. We hope that our analysis can inform future ethics guidance for authors, and document the outcome of USENIX Security's 2025 push towards engaging deeply with ethics in computer security research.

Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. The attacks disrupt day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The evolving threat of software supply chain attacks has garnered interest from both the software industry and governments worldwide in improving software supply chain security. On Thursday, July 9th, 2025, 3 researchers from the NSF-backed Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 12 participants from 6 US government agencies. The goals of the Summit were: (1) to enable sharing between participants from different industries regarding practical experiences and challenges with software supply chain security; (2) to help form new collaborations; and (3) to learn about the challenges facing participants to inform our future research directions. The summit consisted of discussions of six topics relevant to the government agencies represented, including software bill of materials (SBOMs); compliance; malicious commits; build infrastructure; culture; and large language models (LLMs) and security. For each topic of discussion, we presented participants with a list of questions to spark conversation and an overview of the discussions of two industry summit held in the past year. In this report, we provide a summary of the summit. The initial discussion questions for each topic are provided in the appendi

Today's digital ecosystem relies heavily on software supply chains, which enable developers to reuse code and ship software at scale. However, a single vulnerable component can jeopardize the entire supply chain. In recent years, cyberattacks in software supply chains have become increasingly common. These attacks can disrupt critical systems and put organizations, including major software companies, government agencies, and open-source contributors, at risk. This growing threat has led to increased attention from both the software industry and the U.S. government toward strengthening software supply chain security. On September 15, 2025, three researchers from the NSF-backed Secure Software Supply Chain Center (S3C2) convened a Secure Software Supply Chain Summit, bringing together 10 practitioners from 8 organizations across diverse domains. The goals of the Summit were threefold: (1) to facilitate cross-industry sharing of practical experiences and challenges in securing software supply chains; (2) to foster new collaborations among participants; and (3) to identify pressing challenges to guide future research directions. The Summit featured discussions on six central topics: vulnerable dependencies, component and container choice, malicious commits, build infrastructure, culture, and the role of LLMs in the supply chain. For each topic, participants engaged with a curated set of discussion questions designed to gather insights and pain points. This report summarizes the key takeaways from these discussions. Each section highlights which topics continued from previous summits and which ideas emerged for the first time in this summit; the full list of initial discussion prompts is provided in the appendix.

While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks, specifically targeting vulnerable links in critical software supply chains. These attacks disrupt the day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The ever-evolving threat of software supply chain attacks has garnered interest from the software industry and the US government in improving software supply chain security. On September 20, 2024, three researchers from the NSF-backed Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 12 practitioners from 9 companies. The goals of the Summit were to: (1) to enable sharing between individuals from different companies regarding practical experiences and challenges with software supply chain security, (2) to help form new collaborations, (3) to share our observations from our previous summits with industry, and (4) to learn about practitioners' challenges to inform our future research direction. The summit consisted of discussions of six topics relevant to the companies represented, including updating vulnerable dependencies, component and container choice, malicious commits, building infrastructure, large language models, and reducing entire classes of vulnerabilities.

Vulnerability disclosures are necessary to improve the security of our digital ecosystem. However, they can also be challenging for researchers: it may be hard to find out who the affected parties even are, or how to contact them. Researchers may be ignored or face adversity when disclosing vulnerabilities. We investigate researchers' experiences with vulnerability disclosures, extract best practices, and make recommendations for researchers, institutions that employ them, industry, and regulators to enable effective vulnerability disclosures.

Ethical questions are discussed regularly in computer security. Still, researchers in computer security lack clear guidance on how to make, document, and assess ethical decisions in research when what is morally right or acceptable is not clear-cut. In this work, we give an overview of the discussion of ethical implications in current published work in computer security by reviewing all 1154 publications at top 4 security conferences published in 2024, finding inconsistent levels of ethics reporting with a strong focus of reporting institutional or ethics board approval, human subjects protection, and responsible disclosure, and a lack of discussion of balancing harms and benefits. We further report on the results of a semi-structured interview study with 24 computer security and privacy researchers (among whom were also: reviewers, ethics committee members, and/or program chairs) and their ethical decision-making both as authors and during peer review, finding a strong desire for ethical research, but a lack of consistency in considered values, ethical frameworks (if articulated), decision-making, and outcomes. We present an overview of the current state of the discussion of ethics and current de-facto standards in computer security research, contributing suggestions to improve the state of ethics in computer security research.

Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. These attacks disrupt the day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The ever-evolving threat of software supply chain attacks has garnered interest from both the software industry and US government in improving software supply chain security. On Thursday, March 6th, 2025, four researchers from the NSF-backed Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 18 practitioners from 17 organizations. The goals of the Summit were: (1) to enable sharing between participants from different industries regarding practical experiences and challenges with software supply chain security; (2) to help form new collaborations; and (3) to learn about the challenges facing participants to inform our future research directions. The summit consisted of discussions of six topics relevant to the government agencies represented, including software bill of materials (SBOMs); compliance; malicious commits; build infrastructure; culture; and large language models (LLMs) and security. For each topic of discussion, we presented a list of questions to participants to spark conversation. In this report, we provide a summary of the summit. The open questions and challenges that remained after each topic are listed at the end of each topic's section, and the initial discussion questions for each topic are provided in the appendix.

The Heilmeier Catechism consists of a set of questions that researchers and practitioners can consider when formulating research and applied engineering projects. In this article, we suggest explicitly asking who is included and who is left out of consideration.

Digital security advice is the focus of much research, with unsatisfying results: End users do not follow experts' security advice, and users and experts struggle to prioritize existing advice. Several studies point out that users are over-whelmed by the amount of available security advice, and make recommendations on how to improve existing advice. Nevertheless, we still do not know how to effectively give security advice. Inspired by daily habit apps, we developed a set of 30 pieces of short and actionable advice, and the Security App, an Android smartphone app to provide this advice to end users, to reduce mental effort, and to build secure habits. We conducted a 30-day online end-user (N=74) study to evaluate whether the set of advice is actionable and meaningful to users, whether users adopt the advice, and whether the app has an impact on security awareness and behavior. Our results show that the app is an appropriate tool to provide security advice to end users. Participants perceive the majority of tasks as comprehensible, actionable, and useful, and we show that the app in fact introduces secure behaviors. Our results can serve as a basis for future research on security advice and creating secure habits, and the possibility to effectively teach secure behavior.

Software developers face risks of leaking their software secrets, such as API keys or passwords, which can result in significant harm. Secret management tools (SMTs), such as HashiCorp Vault Secrets or Infisical, are highly recommended by industry, academia, and security guidelines to manage secrets securely. SMTs are designed to help developers secure their secrets in a central location, yet secrets leaks are still commonplace, and developers report difficulty in learning how to setup and use SMTs. While SMTs typically come with publicly available help resources (e.g., tool documentation and interfaces), it is unclear if these actually help developers learn to effectively use SMTs. Without usable help resources that onboards developers, quick adoption and effective use of SMTs may be unrealistic. In a qualitative two-step study, we observed 21 new users in person while they used SMTs to perform two secret management tasks: secret storage and access, then secret injection. We interviewed participants after each task to identify their challenges and experiences using SMTs, with the assistance of help resources. While our study sample is narrow, it serves as a reasonable proxy for new developers who are likely to adopt SMTs early in their careers. We found that even in a laboratory setting where new users found tool functionality, interface flexibility helpful, they still experienced increased difficulty to effectively use SMTs to securely remediate a hard-coded secret when they felt tool documentation was insufficient and it motivated participants to deviate from official tool documentation to access secondary sources or attempt workaround methods. Specific challenges reported by participants were tool documentation content quality, navigation difficulties with both tool documentation and web interfaces for finding helpful content, and supportive tool features.

Despite over two decades of usable security and privacy (S&P) research, there remains a yawning gap between expert-recommended S&P advice and user behavior. The Security and Privacy Acceptance Framework (SPAF) identifies awareness, motivation, and ability as main factors influencing S&P behavior. The inclusive S&P literature highlights the importance of user diversity, yet there are open questions regarding how and why sociodemographic differences in S&P emerge. We apply SPAF to analyze interview data from 47 participants with varying age, gender, education, income, (dis)ability, and expertise. Our findings highlight seven new underlying factors not covered by SPAF (e.g., how experiences with threats and doing one's own research contribute to awareness) and four barriers (e.g., limited social support). Drawing from our findings, we establish the notion of differential access as a new concept to consider for inclusive S&P research beyond system-level accessibility: Users' access to S&P protections and information largely hinges on their social and relational position within the society and access to resources, which varies across sociodemographics.

Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US and EU governments and industry are equally interested in enhancing software security, including supply chain and vulnerability response. On June 26, 2025, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) and the Software Innovation Campus Paderborn (SICP) conducted a Vulnerability Response Summit with a diverse set of 9 practitioners from 9 companies. The goal of the Summit is to enable sharing between industry practitioners having practical experiences and challenges with software supply chain security, including vulnerability response, and helping to form new collaborations. We conducted five panel discussions based on open-ended questions regarding experiences with vulnerability reports, tools used for vulnerability discovery and management, organizational structures to report vulnerability response and management, preparedness and implementations for Cyber Resilience Act1 (CRA) and NIS22, and bug bounties. The open discussions enabled mutual sharing and shed light on common challenges that industry practitioners with practical experience face when securing their software supply chain, including vulnerability response. In this paper, we provide a summary of the Summit. Full panel questions can be found in the appendix.

There are few insights into how users' perspectives on smart home security and privacy differ depending on device category. This may leave the smart home community at a disadvantage in knowing how to focus user education efforts to address device-specific misunderstandings or concerns. As a result, consumers may remain uninformed or lack motivation to protect some device categories, leaving devices and data vulnerable. Towards closing this gap, we conducted a between-subjects survey of 401 U.S. smart home users with devices in five categories: voice assistants, thermostats, security devices, sensors, and lighting. Participants found voice assistants to be most problematic and were most confident about security devices and thermostats. We also report novel results related to lack of trust of lighting device manufacturers and general comfort with sensor security and privacy. Our identification of differences across device categories can contribute to greater user empowerment through tailored smart home user education materials.

In Pakistan, where dating apps are subject to censorship, Facebook matrimony groups-also referred to as marriage groups-serve as alternative virtual spaces for members to search for potential life partners. To participate in these groups, members often share sensitive personal information such as photos, addresses, and phone numbers, which exposes them to risks such as fraud, blackmail, and identity theft. To better protect users of Facebook matrimony groups, we need to understand aspects related to user safety, such as how users perceive risks, what influences their trust in sharing personal information, and how they navigate security and privacy concerns when seeking potential partners online. In this study, through 23 semi-structured interviews, we explore how Pakistani users of Facebook matrimony groups perceive and navigate risks of sharing personal information, and how cultural norms and expectations influence their behavior in these groups. We find elevated privacy concerns among participants, leading them to share limited personal information and creating mistrust among potential partners. Many also expressed concerns about the authenticity of profiles and major security risks, such as identity theft, harassment, and social judgment. Our work highlights the challenges of safely navigating Facebook matrimony groups in Pakistan and offers recommendations for such as implementing stronger identity verification by group admins, enforcing stricter cybersecurity laws, clear platform guidelines to ensure accountability, and technical feature enhancements-including restricting screenshots, picture downloads, and implementing anonymous chats-to protect user data and build trust.

Although smart home adoption in the United States (U.S.) is growing, smart home users may harbor security and privacy concerns or uncertainty about how to best protect their devices and the data those collect. Further, there have been few insights into how users’ perspectives on smart home security and privacy differ depending on device category. This may leave the smart home community at a disadvantage in knowing how to focus user education efforts to address device- specific misunderstandings or concerns. As a result, consumers may remain uninformed or lack motivation to protect some device categories, leaving devices and data vulnerable. Towards closing this gap, we conducted a survey of 401 U.S. smart home users with devices in five categories: lighting, security devices, sensors, thermostats, and voice assistants. Participants viewed voice assistants as most problematic and were most confident about security devices and thermostats. We also report novel results related to perceptions of smart home security and privacy responsibility and users’ thoughts on device categories seldom explored in research. Our identification of differences across device categories can contribute to greater user empowerment through tailored smart home user education materials.

In Pakistan, where dating apps are subject to censorship, Facebook matrimony groups – also referred to as marriage groups – serve as alternative virtual spaces for members to search for potential life partners. To participate in these groups, members often share sensitive personal information such as photos, addresses, and phone numbers, which exposes them to risks such as fraud, blackmail, and identity theft. To better protect users of Facebook matrimony groups, we need to understand aspects related to user safety, such as how users perceive risks, what influences their trust in sharing personal information, and how they navigate security and privacy concerns when seeking potential partners online. In this study, through 23 semi-structured interviews, we explore how Pakistani users of Facebook matrimony groups perceive and navigate risks of sharing personal information, and how cultural norms and expectations influence their behavior in these groups. We find elevated privacy concerns among participants, leading them to share limited personal information and creating mistrust among potential partners. Many also expressed concerns about the authenticity of profiles and major security risks, such as identity theft, harassment, and social judgment. Our work highlights the challenges of safely navigating Facebook matrimony groups in Pakistan and offers recommendations for such as implementing stronger identity verification by group admins, enforcing stricter cybersecurity laws, clear platform guidelines to ensure accountability, and technical feature enhancements – including restricting screenshots, picture downloads, and implementing anonymous chats – to protect user data and build trust.

Reusable software libraries, frameworks, and components, such as those provided by open-source ecosystems and third-party suppliers, accelerate digital innovation. However, recent years have shown almost exponential growth in attackers leveraging these software artifacts to launch software supply chain attacks. Past well-known software supply chain attacks include the SolarWinds, log4j, and xz utils incidents. Supply chain attacks are considered to have three major attack vectors: through vulnerabilities and malware accidentally or intentionally injected into open-source and third-party dependencies/components/containers ; by infiltrating the build infrastructure during the build and deployment processes; and through targeted techniques aimed at the humans involved in software development, such as through social engineering. Plummeting trust in the software supply chain could decelerate digital innovation if the software industry reduces its use of open-source and third-party artifacts to reduce risks. This paper contains perspectives and knowledge obtained from intentional outreach with practitioners to understand their practical challenges and from extensive research efforts. We then provide an overview of current research efforts to secure the software supply chain. Finally, we propose a future research agenda to close software supply chain attack vectors and support the software industry.

Unified Payments Interface (UPI) payment systems are widely used in India and are also gaining global traction. UPI enables people to make quick everyday transactions and recurring payments, including rent, gas, and electricity, using the same app. The widespread adoption of UPI has sparked significant concerns regarding users' security and privacy, especially due to an alarming number of UPI-related scams and fraudulent transactions. While prior work has explored the technical security of UPI [1], [2], to address security threats effectively, we must understand user mental models, concerns, security information sources, and behaviors. In a mixed-methods study of 26 semi-structured interviews with UPI users from India and content analysis of 16 security information sources from regulatory bodies, UPI apps, and banks offering UPI, we explore user mental models, concerns, where and how they receive security advice, as well as their security-relevant behaviors. We provide an analysis of users' concerns and threats around UPI security and privacy and highlight gaps where official advice falls short. Further, we recommend UPI providers and banks to curate accessible and useful advice to better alleviate users' concerns, and increase their reach. We also recommend individual security and privacy practices for UPI users to protect themselves.