[m000]

I know of at least two security-related workshops that explicitly call for "negative results". So, even failures in this research field are definitely publishable, if accompanied with adequate insights.