Eye-tracking lets us see attention directly. In our studies, patterns of fixation and content-skipping help explain why some learners miss security-relevant details even when they know the rule.