\section{Practical Strategies}
Based on the evaluations conducted on both theoretical research and various tools within the field of security visualization, this chapter aims to outline the limited practical strategies currently available due to the predominantly prototypical status of the field (table \ref{Tab:judgment}). By synthesizing the findings from these evaluations, this chapter sheds light on the scarcity of established strategies and highlights the need for further development and exploration in the field.

The evaluations carried out have revealed that the landscape of practical strategies in security visualization is characterized by a paucity of mature and widely adopted approaches. Many existing solutions are still in prototype stages or experimental phases, hindering their practical applicability. This dearth of available strategies poses a significant challenge for researchers and practitioners seeking well-established frameworks to address the complexities and demands of the security field.

While the evaluations have identified some promising methodologies and tools, it is important to acknowledge the nascent state of their development and implementation. These emerging strategies hold immense potential but require further refinement and validation to ensure their effectiveness and reliability in real-world scenarios. The limited availability of practical strategies underscores the pressing need for continued research and development efforts in security visualization to bridge the gap between theoretical advancements and practical applications.

In addition to the prevalent prototypical nature identified, the research has highlighted a significant limitation in the overall development state of these solutions. Consequently, the majority of these prototype tools are rendered inapplicable in most cases. As a primary concern, it is crucial to address the need for further advancements aimed at transforming these prototypes into functional applications suitable for real-world contexts. However, it is important to note that such development efforts incur high costs, making this strategy feasible only in specific cases where it is deemed necessary and viable.

Based on the identified available solutions that have exhibited superior efficacy compared to others, it is possible to ascertain potential strategies to be pursued (table \ref{Tab:judgment}). These strategies are derived from the insights garnered through the evaluation and analysis of existing options. By leveraging the strengths and accomplishments of these solutions, organizations can establish a framework for formulating and implementing their own effective strategies.

A prime example of this is the potential utilization of the Code Pulse \ref{code_pulse} tool within a development and penetration testing context to accurately measure the coverage of the attack surface in real-time during both manual and automated testing. The tool's functionalities enable swift identification and feedback on the coverage of the tested application. As stated in its description, its ability to integrate with well-established development environments such as Java and .NET ensures considerable compatibility in a real-world landscape, making it a readily applicable tool in practical settings.

Shifting our focus from vulnerability analysis to threat analysis, the previous chapters have presented two solutions that demonstrate practical applicability in real-world contexts, which hold the potential to facilitate effective threat identification strategies. In the first case SAGE \ref{sage} is a supervised sequence learning tool that generates succinct attack graphs (AG) directly from raw intrusion alerts, without relying on prior knowledge. Its functionality allows analysts to identify vulnerable systems and gain detailed insights, enabling efficient resource organization and prioritization. Notably, the tool's compatibility with Suricata, a widely adopted intrusion detection system, enhances its usability. Furthermore, the availability of a Docker containerized version enables seamless integration into diverse existing infrastructures. These characteristics make SAGE well-suited and readily applicable in real-world contexts.

In the second case, we encounter a solution that distinguishes itself from other tools by being purposefully developed to be applicable in real-world contexts. RedEye \ref{redeye} is an open-source analytical tool specifically designed to assist Red Teams in visualizing and reporting command and control activities. Unlike the previously discussed examples, the significance of RedEye extends beyond a specific task or a set of features. It stands out as the sole instance within this study that offers an open-source alternative capable of replacing potentially paid counterparts. This unique characteristic of RedEye makes it a noteworthy solution within the context of this research. Its open-source nature not only promotes transparency and collaboration but also provides organizations with a cost-effective option for enhancing their red teaming activities. By leveraging RedEye, analysts can effectively visualize and report command and control activities, enabling them to identify potential threats and devise appropriate countermeasures. Furthermore, the tool's flexibility and adaptability make it well-suited for integration into existing infrastructures, thereby facilitating seamless adoption and utilization. The availability of comprehensive documentation and active community support further contributes to its practicality and viability as a real-world solution.

It is important to acknowledge that the discussion thus far has focused on a subset of solutions deemed suitable for practical implementation. Another possibility lies in building one's own application, leveraging the practical and theoretical foundations laid by the tools discussed in this work. By utilizing these tools as a starting point, organizations can tailor their application to meet their specific needs and requirements. This approach offers the advantage of customization and flexibility, allowing for the integration of additional functionalities or the adaptation of existing ones. Considering the extensive prototypical state observed and the consequent inability to offer specific features and functionalities in a real-world setting, this alternative holds validity, particularly for those seeking to circumvent the adoption of proprietary solutions. Nevertheless, it is worth noting that the research findings indicate a lack of robust open-source alternatives at present, further emphasizing the need for further development and advancement in this domain.




