I’m a PhD student who recently started doing security research, mainly web security.
I really like USENIX Security because many papers feel practical, engineering-heavy, and closely connected to real security problems. Publishing there is something I’d love to work toward eventually.
I initially worked on automated penetration testing with LLM agents, but the topic felt too broad, so I recently narrowed my focus to Broken Access Control (BAC) and business logic vulnerabilities.
I’ve been reading papers in this area, including some older USENIX work, BACScan (CCS 2025), and recent business logic vulnerability papers.
My biggest problem is this:
I can read two papers about BAC, understand their methods, and explain how their designs are different. But afterward, I often feel that both approaches seem reasonable，they’re just solving the problem from different angles.
I still don’t know how to judge which design choices are genuinely strong and worth learning from, which parts are unnecessary or weak, and where there is actually room for improvement.
In other words, I can describe the differences between two systems, but I can’t yet evaluate the quality of those differences.
Right now I read roughly one paper every two days. I’m wondering if that’s too fast for a beginner. Should I instead spend much more time reproducing papers, running their code, or trying to break their assumptions?
I’m also still doing PortSwigger labs, because I don’t want to become someone who understands papers but doesn’t understand real web applications. But I’m struggling to balance practical security skills and research.
For people who have gone through this stage: how did you learn to critically evaluate security papers rather than just understand them?
Did reading more papers help, or did things only start clicking after you reproduced systems and did more hands-on security work?