Ivan Flechais

Professor Ivan Flechais

Associate Professor of Computer Science

Themes:

Completed Projects:

Interests

My research focuses on human-centred cybersecurity and the design of secure socio-technical systems. I am interested in how security and privacy can be engineered to work effectively in the real-world contexts in which technologies are designed, deployed, and used. This means looking beyond technical security mechanisms to understand the human, organisational, social, and cultural factors that shape security outcomes.

A longstanding strand of my work has explored how usability, security, and software engineering can be brought together in the design process. More recently, my research has increasingly moved beyond the individual user to examine how security and privacy are experienced and negotiated collectively. This includes work on smart homes, communal and bystander privacy, ultra-large systems, remote and shadow security practices, data protection, and AI-enabled threats. Across these areas, I am interested in how responsibility, trust, power, and control are distributed between individuals, groups, organisations, and the technologies they rely on.

My current interests concern security as a collective and relational phenomenon: how security practices emerge from interactions between people, technologies, organisational structures, and wider social contexts. I am particularly interested in situations where different actors have competing needs, unequal levels of power, or shared responsibility for security, and in how these tensions can be recognised and addressed through better design. As digital systems become more interconnected and increasingly mediated by AI, I am interested in developing approaches to cybersecurity that account for these wider relationships, including the ways in which security responsibilities, expertise, and demands are distributed across individuals, organisations, and technical systems.

DPhil Applications

I am open to accepting DPhil students wanting to pursue research that aligns with my interests. If you contact me about a possible DPhil place, please explain what kind of research you would like to undertake, why you think it is important, and how it relates to my research interests.

I am looking for evidence that you have thought seriously about the research problem and have a reasonable understanding of what research in this area would involve. A useful initial proposal would normally include a couple of pages discussing the problem, relevant prior research, possible research questions, and how you might go about investigating them. This is much more useful than a narrative version of your CV.

Please make sure you have read and understood several relevant research papers and can explain how your proposed work relates to them. If you use AI tools when preparing your proposal, the resulting text should accurately reflect your own ideas and understanding, and you should be able to discuss and defend everything you submit.

Biography

I am an Associate Professor of Computer Science at the University of Oxford, where my research focuses on human-centred cybersecurity and the design of secure socio-technical systems. Over more than 25 years, my work has explored how security and privacy can be designed to reflect the needs, behaviours, and constraints of the people and organisations who use, develop, and operate digital technologies.

My research has contributed to the development of usable security as a socio-technical engineering discipline, spanning secure systems design, security requirements, human-computer interaction, software engineering, privacy, smart technologies, and organisational security practices. This work has attracted more than £2.5 million in external funding from organisations including EPSRC, the Information Commissioner’s Office, DCMS/Innovate UK, and CyBOK, and has been published in leading venues including CHI, CSCW, USENIX Security, SOUPS, and the International Journal of Human–Computer Studies. It has also received a USENIX Security Distinguished Paper Award and a CSCW Impact Recognition Award.

More recent work has increasingly moved beyond the individual user to examine how security and privacy are shaped by relationships between people, technologies, and organisations. This includes research on privacy and power in smart homes, the user experience of data protection, remote and shadow security practices, AI-enabled deception, and the wider human and organisational consequences of cybersecurity work. Across these areas, I am particularly interested in how responsibility, trust, power, and security practices are distributed across groups, organisations, and increasingly complex socio-technical environments.