Women Shaping the Future of Technology Era: Why Our Voices Matter
How one researcher is bridging the gap between AI confidence and correctness—and opening doors for the next generation.
Confidence Is Not the Same as Being Right
When I started my doctorate, I was studying people, not machines. The subject was something I called social noise, which is the distortion a message picks up as it moves through social media. A public health message goes out about masking during a pandemic, and by the time it reaches most people, it has been reshaped by argument, bad-faith reposting, and ordinary misunderstanding. I studied masking guidance during COVID-19, the way the Black Lives Matter message changed as it spread, and how people talked about climate during extreme weather. Some of that ran in the Journal of Information Science and the Journal of Information and Knowledge Management, and a paper I gave at the Association for Information Science and Technology on measuring the uncertainty involved was later ranked in the top ten percent of most-viewed papers the journal published that year.
Looking back, I was studying one thing the whole time. A message can arrive sounding completely certain and still be wrong. The confidence and the accuracy come apart.
That gap is now the central problem in cybersecurity, and it is where nearly all of my research has gone.
When the security fix isn't a fix
A lot of organizations have started handing their security problems to language models. You have a vulnerability somewhere in your infrastructure code, so you ask the model to repair it, and it hands back something that looks like a repair. My colleagues and I wanted to know whether those repairs hold up.
Often, they don't, and the way they fail is what worries me. The model returns code that satisfies the automated security scanner while leaving the vulnerability sitting there. Your check comes back clean. Your pipeline moves ahead. The hole is still open. We started calling these deceptive fixes, and we built a layered oracle framework to catch them, along with a taxonomy of the ways this failure shows up, because a scanner was never designed to notice a repair that only looks like one. The work has been accepted at Empirical Software Engineering and at the International Conference on Tools with Artificial Intelligence, and I am now extending it to look at what these AI-generated repairs change in your infrastructure that nobody asked them to change.
I find this problem genuinely serious. Automated repair is being adopted quickly because it saves an enormous amount of time, and the time savings are real. What is also real is that the verification layer we would need in order to trust it does not exist yet. We are building the plane in the air.
Securing systems that act on their own
The next version of this problem is already arriving. Agentic AI systems don't just answer questions; they take actions, call other tools, and chain those actions together without a person approving each step. Every one of those handoffs is a place where something can be injected, misdirected, or quietly corrupted, and the existing security models weren't built with any of it in mind.
I am working on a multi-tiered security framework for agentic AI called AONIX, which received a collaboration award from the Texas A&M Engineering Experiment Station this year. My colleagues and I have also published a meta-review of where cybersecurity is heading over the next several years, pulling together what the literature actually agrees on and where it doesn't. That kind of survey isn't glamorous work, but you cannot defend a field you haven't mapped.
Whether the numbers mean anything
Underneath the security work is a question about evaluation that keeps surfacing. When a model tops a benchmark, what has it actually demonstrated?
We applied a validity-centered evaluation framework to current frontier models and found that leading on one benchmark tells you much less about general capability than the field assumes. This is not an academic quibble. Agencies and companies are choosing which systems to deploy in security-sensitive settings on the strength of exactly these numbers, and if the numbers don't generalize, the deployment decisions inherit that weakness.
I have been asking a version of the same question about misinformation, testing how well AI models detect it when you give them defined social noise constructs to work with, which brings my old research and my current research into the same paper. And in medical imaging, where a confidently wrong answer is more dangerous than an uncertain one, I work on calibration in breast ultrasound segmentation so that a system's confidence tracks how reliable it actually is.
Different domains, one question. The system sounds sure of itself. Somebody has to check whether it should be.
Where the next people come from
The teaching side of this matters as much to me. I teach information security, digital forensics, and big data at East Texas A&M, and I have worked on proposals for a master's in cybersecurity, a master's in information science, and new AI degree programs, because students cannot enter a field their university doesn't teach.
I am also putting together an NSF proposal to build a cybersecurity and AI workforce pipeline aimed at rural regions. The argument is simple. These are among the fastest-growing jobs in the country, the shortage of qualified people is severe, and rural students are almost entirely missing from the routes that lead into them. The ability is there. The pathway isn't.
But building programs is the easy part. What actually changes a student's direction is being treated as a researcher slightly before you have earned the title.
So I put my students on my papers. Two of my students here are co-authors on work submitted to an IEEE conference on classifying movement using pose estimation and neural networks. Another is a co-author on our paper about automating clinical trial enrollment, which I presented in Lisbon. Another presented her own poster at the Texas A&M Global Cyber Research Institute last October, and I stood at the back watching her explain her research to people twenty years further along than she is, visibly nervous, doing it anyway. She was entirely capable of being there. What she needed was for someone to get her into the room.
That is most of what mentoring turns out to be. Advice is easy to come by and worth roughly what you pay for it. Access is harder. It means saying someone's name in a meeting when she isn't there to say it herself, or asking her to take something on a little before she thinks she is ready, because almost nobody feels ready, and the waiting is where careers quietly stop.
I finished my PhD while raising four children, and I started out running a computer lab at a college in Irbid, Jordan. People sometimes tell that back to me as a story about determination. It was partly that. It was also a story about specific people who opened specific doors at moments I could not have engineered on my own, and I try not to be sentimental about how much of it depended on them.
Which is why I open them now. If you are a woman looking at cybersecurity or AI and wondering whether there is room in it, I can tell you there is an enormous amount of technology in the world that nobody has examined carefully, and not nearly enough people willing to do the examining.
