Prioritizing privacy and security advice is a particular challenge for at-risk users, requiring difficult judgment calls with the risk of harmful consequences. We interviewed 18 experts who tailor privacy and security advice for at-risk users in personalized consultations and trainings, to understand their strategies and challenges. We identify five main objectives that experts balance as they differentiate the content and delivery of advice, and we explore how different types of context about clients are used to achieve those objectives. We also describe four methods used to ascertain this context, which have different trade-offs regarding priorities such as using time efficiently and managing the reliability of information. Through this, we especially focus on the challenges and rationales that motivate providers to follow particular practices. By surfacing choices that experts make about advice differentiation and by identifying areas for researchers and technologists to assist experts, our work can inform next steps in research, tool design, and ultimately better advice for at-risk users.

Fuzzing is a widely adopted technique for uncovering software vulnerabilities by generating random or mutated test inputs to trigger unexpected behavior. However, little is known about how developers actually use fuzzing tools in practice, the challenges they face, and where current tools fall short. This study investigates the human side of fuzzing via 18 semi-structured interviews with fuzzing users across diverse domains. These interviews explore participants' workflows, frustrations, and expectations around fuzzing, revealing critical usability gaps and design opportunities. Our results can inform the next generation of fuzzing tools to improve user experience, reduce manual effort, and enable more effective integration of fuzzing into real-world workflows.

De-identifying microdata is necessary yet difficult. Myriad techniques exist, which reduce risk and preserve utility to varying, often unclear extents. We conducted a thematic analysis of 38 online de-identification guides for practitioners, to understand what content they contain and how they are designed to support decision-making and execution. We highlight trends and differences between guides, and we find some concerning patterns, including inconsistent definitions of key terms, gaps in coverage of threats to de-identification, and areas for improvement in usability. We identify directions for future research and suggest changes to de-identification guidance in order to better support practitioners in conducting effective de-identification.