Every professor I have actually talked to about what constitute a thesis has professed the staple method: you take your best research papers and staple them together. This is an exaggeration, of course, because the document actually has to flow, but I have the definite impression that you can get a Ph.D. in computer security with multiple at least somewhat discrete projects.