This website stores cookies on your computer. These cookies are used to collect information about how you interact with our website and allow us to remember your browser. We use this information to improve and customize your browsing experience, for analytics and metrics about our visitors both on this website and other media, and for marketing purposes. By using this website, you accept and agree to be bound by UVic’s Terms of Use for web and social media privacy.  If you do not agree to the above, you can configure your browser’s setting to “do not track.”

Skip to main content
People Departments Maps Buildings Rooms A-Z
University
of Victoria
Apply Library
Sign in Online tools Sign out
Faculty of Graduate Studies

Alessandra Maciel Paz Milani

Notice of the Final Oral Examination for the Degree of Doctor of Philosophy

Topic

From Understanding to Design: Human-Centered Cognitive Support for Threat Hunters

Department of Computer Science

Date & location

  • Thursday, August 20, 2026

  • 2:00 P.M.

  • Engineering Computer Science Building

  • Room 555 and Virtual Defence

Reviewers

Supervisory Committee

  • Dr. Margaret-Anne Storey, Department of Computer Science, University of Victoria (Supervisor)

  • Dr. Miguel Nacenta, Department of Computer Science, UVic (Member)

  • Dr. Issa Traore, Department of Electrical and Computer Engineering, UVic (Outside Member)

External Examiner

  • Dr. Jaron Mink, School of Computing and Augmented Intelligence, Arizona State University 

Chair of Oral Examination

  • Dr. Malcolm Gaston, School of Public Administration, UVic

     

Abstract

Cybersecurity increasingly relies on threat hunters to proactively identify adversaries that evade automated defenses. Although detection technologies continue to advance, the cognitive work underlying threat hunting remains underexplored and insufficiently supported by existing tools. Threat hunters must navigate large volumes of heterogeneous data, construct investigative narratives under time pressure, manage uncertainty, and collaborate across teams. Yet most security systems emphasize automation and data processing rather than support for human reasoning and sense-making. This Ph.D. dissertation adopts a human-centered perspective to examine how threat hunters think, work, and build understanding during investigations. Across three interconnected studies, it investigates the cognitive and collaborative dimensions of threat hunting and develops tool design strategies to better support this critical role. The first study draws on interviews with 20 threat hunters to identify 17 key dimensions of their characteristics and work practices, resulting in four personas that inform user-centered design. The second study builds on these findings through in-depth observations of six threat hunting sessions, identifying 23 themes that capture cognitive and workflow challenges. From this analysis, a model of how threat hunters construct and refine mental models during investigations is introduced, along with design propositions for cognitive supportive tools. The third study operationalizes these design propositions through the design of the Threat Hunter Board and its evaluation with ten cybersecurity analysts, including six participants who completed an online survey and four who participated in semi-structured interviews. Together, these studies argue that the next advancement in cybersecurity tools lies not in replacing human judgment with automation, but in augmenting human cognition. By grounding tool design in empirical understanding of threat hunters’ mental processes, this research contributes theoretical insight, practical design guidance, and a validated prototype toward transforming cybersecurity systems from data-intensive platforms into meaningful partners in investigative reasoning.

Back to oral exams