You only get a cool paper with lots of citations if you actually do find a new attack. If you spend a four year PhD searching and come up with nothing, which is

You only get a cool paper with lots of citations if you actually do find a new attack. If you spend a four year PhD searching and come up with nothing, which is what the field tells you to expect, then you end up with nothing. At the NSA you get a four year salary, maybe even a promotion, who knows.