Mengyuan Zhang

Mengyuan Zhang, also known as Maggie Zhang, is a computer scientist whose work centers on measuring and quantifying cybersecurity risk, with particular attention to how human judgment, machine learning, and software vulnerabilities interact. Since 2024, she has held an Assistant Professor position in the Foundational and Experimental Security group of the Department of Computer Science at Vrije Universiteit Amsterdam. Her research spans security quantification, vulnerability assessment, cloud and 5G security, and the application of machine learning to security problems. As of 2026, her recorded output at VU Amsterdam’s institutional repository includes 22 conference contributions, 11 journal articles, and 2 book chapters.

Key facts

  • Occupation: computer scientist
  • Employer: Vrije Universiteit Amsterdam
  • Education: Concordia University

Education and early career

Zhang completed both her Bachelor of Engineering and Master of Engineering in Information Security at Nanjing University of Posts and Telecommunications. She then moved to Canada to pursue doctoral research at Concordia University in Montreal, working under the supervision of Professor Lingyu Wang. Her PhD, in Information and Systems Engineering, was awarded in 2018.

Early in her research career, she contributed to the study of network diversity as a tool for evaluating how well a network could resist zero-day attacks. A predecessor paper on that topic, ‘Modeling Network Diversity for Evaluating the Robustness of Networks against Zero-Day Attacks,’ appeared at the European Symposium on Research in Computer Security (ESORICS) in 2014, on pages 494 through 511.

Research focus

Zhang’s research interests cover security quantification, security metrics, human factors in cybersecurity, software security, vulnerability assessment, cloud computing, 5G security and privacy, and applied machine learning in security.

That paper borrowed biodiversity metrics from ecology, applying a concept based on the effective number of distinct resources to the problem of quantifying network security.

At the ACCSS Security and AI Workshop on October 23, 2025, she delivered a keynote titled ‘Quantifiable Security: Challenges and Opportunities in the Age of AI,’ addressing how the rise of AI systems reshapes both the threats and the measurement tools available to security researchers.

Active projects at VU Amsterdam

Zhang is Principal Investigator on the Sec4AI4Sec project, formally titled ‘Cybersecurity for AI-Augmented Systems.’ The project runs from October 1, 2023 to September 30, 2026 and is funded by the European Union’s Horizon Europe research and innovation programme under grant agreement No 101120393. The consortium behind the project spans 5 universities (Amsterdam, Cagliari, Hamburg, Lugano, and Trento), 2 SMEs, 3 large enterprises including Airbus, SAP, and Thales, and 1 digital innovation center. VU Amsterdam colleague Fabio Massacci is among her collaborators on the project, and together they co-supervise PhD student Siqi Zhang, whose work concerns vulnerability prioritization.

She also participates in the THESEUS project at VU Amsterdam, which focuses on helping organizations patch security vulnerabilities faster and more efficiently.

Selected recent publications

In April 2026, Zhang co-authored two papers presented at CHI 2026 in Barcelona, Spain. The first, ‘Tool-Assisted CVSS Vulnerability Scoring: A Controlled Quantitative Study of Human Assessment,’ examines how human assessors score software vulnerabilities when supported by automated tools. The second, ‘NeuroWise: A Multi-Agent LLM Glass-Box System for Practicing Double-Empathy Communication with Autistic Partners,’ appeared in the CHI 2026 Extended Abstracts and reflects the breadth of her interest in human factors and AI systems.

In November 2025, she co-authored ‘An AI Security Testbed for the 5G Core,’ presented at the 2025 IEEE International Conference on Cloud Computing Technology and Science (CloudCom), continuing her applied work on securing next-generation mobile infrastructure.

Professional service

As of 2026, Zhang chairs the Security and Defense Specialty Group of the Society for Risk Analysis (SRA). A student in her group at VU Amsterdam, Emanuele, received a Student Merit Award from the SRA in 2025 for research on large language models and cyber threat intelligence risk summarization. That work was presented at the SRA Annual Meeting held December 7 through 10, 2025 in Washington, DC.

Did you know

  • Zhang’s most-cited single paper, on network diversity as a security metric, drew its core idea from ecology. Rather than developing a purely computational measure from scratch, the authors applied a biodiversity-inspired metric based on the effective number of distinct resources to the problem of quantifying network security. (tsapps.nist.gov)
  • Zhang’s research output at VU Amsterdam, as recorded in the institutional repository, spans 22 conference contributions, 11 journal articles, and 2 book chapters. (research.vu.nl)
  • A student in her group, Emanuele, received a Student Merit Award at the Society for Risk Analysis in 2025 for work on large language models and cyber threat intelligence risk summarization. The research was presented at the SRA Annual Meeting held December 7 through 10, 2025 in Washington, DC. (mengyuanzhang.github.io)

Data sources

Data updated: 2026-10-28