\subsection*{Crumbs}
Crumbs \cite{crumbs_paper} is visual analytics solution aimed at addressing the Italian adaptation of the Cyber Security Framework (IACSF), derived from the proposal of the National Institute of Standards and Technology (NIST), targeting security managers. At its core, the framework proposed by NIST consists of five key functions: Identify, Protect, Detect, Respond, and Recover, which provides an understanding of the possible management of cyber security risks. This functions are structured in categories and each category is structured in subcategories which refer to practical actions that must be carried out. The Italian model extends this structure by adding a priority level and a maturity level to each subcategory. The Priority level can take 4 values (Mandatory, High, Medium, and Low) and primarily indicates the order of implementation. The maturity level provides a reference by which each organization can assess the implementation of its subcategories and establish objectives and priorities for their improvement and it can be divided into 4 incremental sublevels ranging from M1, such as mandatory legal actions, to M4, which represents the most sophisticated risk management practices.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.26]{Figures/chapter4/Crumbs/crumbs_intro.png}
    \caption{Crumbs launching page}
    \label{fig:crumbs_intro}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Crumbs/crumbs_iniziale.png}
    \caption{Crumbs first view}
    \label{fig:crumbs_start}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Crumbs/crumbs_gap.png}
    \caption{Crumbs with Gap Analysis}
    \label{fig:crumbs_gap}
\end{figure}


The prototype is available both as an online demo version and as a downloadable code that can be run locally, with both options accessible from the same page \cite{crumbs_site}. In the online demo version sample files are available for usage, while in the local version, it's possible to create a copy of the base Excel framework files and modify them according to different needs. Once the server is started, the file can be uploaded to the application page and initiate the visualization (figure \ref{fig:crumbs_intro}). After selecting the reference framework through the top toolbar, the main view of the application is displayed (figure \ref{fig:crumbs_start}). Once the contextualization, described in the Excel file, is selected, the view is updated to include visual components that refer to the priority level and maturity level. The priority level is represented using a color code (red for mandatory, orange for high priority, yellow for medium priority, green for low priority, and white for no priority), while the maturity level, divided into sub-levels, is indicated by a simple color code to denote whether it has been addressed or not (not addressed=red, partially addressed=half green-half red, fully addressed=green) and it's displayed after the selection of the current profile, which represents the current status of cybersecurity of the organization. In case there is a need to navigate between different controls, it is possible to use the toolbar located on the left side of the functions to adjust the zoom level. Once the current profile is selected, it is possible to enter a ``target profile" to perform a gap analysis by adding two new visualizations (figure \ref{fig:crumbs_gap}). The first one is called ``Gap Analysis" and for each subcategory two bars are depicted, where the left one, with normal colors, represents the status of all the controls associated to the target profile, where green and red represent the percentage of addressed (green) and not addressed (red) controls. The right one, more transparent colors, provides the same information for all controls that are above the target maturity level for the subcategory and mouse-overing on the elements in the gap bars reveals the associated controls along the different maturity levels. The second visualization created is called ``Minimum Coverage" and represents an optimized order of the controls that still need to be addressed to reach the target profile, which can vary depending on the strategies employed (figures \ref{fig:crumbs_strategy1}, \ref{fig:crumbs_strategy2}). On the right side of the main display, there are two bar charts that represent the overall statistics. In the upper image, the frequency distribution of subcategories is visible with respect to degree of coverage, while in the lower image, the frequency distribution of controls is visible with respect to degree of addressing. 

As highlighted by the developers themselves, Crumbs offers a visualization methodology that has not been adopted by other solutions operating in the same field, making it undoubtedly a unique solution of its kind. While it has proven to be a useful solution from the perspective of experts considered for a prototype review, it should not be considered a complete replacement for traditional methods, as it does not allow for the modification of the states of various subcategories. Updating the addressed fields requires a modification to the original document, which poses a significant limitation for the prototype. In addition to this limitation, it is important to note the instability of the offline version of the tool compared to the online demo version, resulting in variations in the page's visualizations that hinder its proper usage.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Crumbs/crumbs_strategy2.png}
    \caption{Crumbs Greedy Coverage Strategy}
    \label{fig:crumbs_strategy2}
\end{figure}
\begin{figure}[!h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Crumbs/crumbs_strategy1.png}
    \caption{Crumbs Minimum Coverage Strategy}
    \label{fig:crumbs_strategy1}
\end{figure}









