\section{Gaps evaluations}
In addition to categorizing cybersecurity tools, it is also important to identify gaps in security measures tested and propose solutions to address them. This subchapter explores the process of evaluating gaps in cybersecurity visualizations and provides possible solutions for mitigating these gaps between theory and practice. By identifying and addressing these gaps in security, organizations and individuals can better protect themselves against potential threats and minimize the impact of security breaches. 

The initial category under examination focuses on the disparity between the ideal objectives of security visualization and the actual outcomes attained, highlighting the presence of missing or inadequately developed elements that warrant further investigation. Upon analyzing the objectives outlined in Chapter 3.3, it becomes apparent that a significant portion of both research endeavors and real-world implementations has predominantly centered around the first two objectives , namely \textbf{Understanding security data} and \textbf{Detecting and responding to security incidents}, in fact a considerable emphasis has been placed on devising diverse solutions to facilitate the comprehension of security-related data.

However, the treatment of the remaining objectives has been comparatively limited, leading to evident gaps, as seen in the case of \textbf{Effectively communicating security information}. Despite the widespread recognition of the significance of information exchange in security and the existing research identifying it as a promising area for further exploration \cite{systematic_literature_review}, it has been observed, in support of what has been expressed by expert feedback, that the majority of methodologies do not adequately facilitate information exchange using visualizations to enhance communication and data comprehension both between experts of the same level and between different stakeholders, such as security experts who communicate with business executives. Another compelling piece of evidence supporting this observation can be derived from Table \ref{Tab:output}, which demonstrates that, in most cases, the ability to extract the produced visualization, even in the standard version intended for experts, has not been adequately developed. This discrepancy underscores a prevailing emphasis on data comprehension rather than effective data dissemination, resulting in an initial gap that could hinder the actual understanding and subsequent mitigation of the identified security issues. Hence, it can be asserted that collaboration and information sharing should be regarded as indispensable components of security visualizations in both research and real-world contexts, in future advancements within the field.

When considering another objective previously defined as \textbf{Supporting decision-making}, it is noteworthy to observe that this characteristic is evident in certain open-source prototype solutions, specifically Vulnus, which offer a range of strategies to assist analyst users in their decision-making processes. This supportive feature facilitates the comparative analysis of diverse outcomes derived from multiple strategies, thereby providing an comprehensive overview of the potential system states, which is crucial in evaluating the various ramifications that could ensue. In contrast to the research domain where this feature is partially present, our examination of real-world applications, specifically enterprise tools, within the scope of our study reveals a notable absence of this characteristic. In the majority of cases, these tools primarily offer ordered information without providing calculated strategies or insights into the ensuing system state, thereby lacking active support for analysts. Therefore, it is apparent that solutions specifically designed for organizations and industries should integrate these visualization methodologies, aiming to provide a form of support that utilizes advanced data analysis techniques derived from AI and ML, as well as contemporary visualization methods that encompass that range from Vulnus' proposed solution to the realm of visual simulations \cite{simulation_paper}.

Upon closer examination and comparison between the theoretical realm, which encompasses the described or hypothesized possibilities derived from research, and the practical realm, which entails the utilization of currently available resources in real-world scenarios among the various analyzed alternatives, it becomes evident that there are some disparities. Specifically, in the practical domain, the predominant visualization techniques and methodologies employed are largely characterized by simplistic representations of standard graphs, which highlights a notable gap in the utilization of recent research advancements, leading to the potential use of suboptimal visualizations that do not effectively fulfill their intended purpose. As the complexity and sophistication of cybersecurity threats continue to evolve, it is crucial to employ visualizations that can capture and convey the intricacies of these threats. Relying solely on standard graphs may lead to oversimplification or incomplete representations, making it challenging for stakeholders, including security experts and business executives, to fully grasp the nuances of the security landscape. To address the gap between theoretical possibilities and practical implementations in security visualization, several strategies can be pursued, like foster closer collaboration and knowledge sharing between researchers and practitioners in the field of security visualization, a choice already widely used on the research side, which can help bridge the gap by incorporating real-world challenges, practical constraints, and industry insights into research efforts, or as evidenced by theoretical research, adopt a user-centered design approach to develop security visualization tools that address the specific needs, requirements, and cognitive abilities of different stakeholders, even in the case of distributed tools for large organizations offering a multitude of services.

Furthermore, it is crucial to examine the potential disparities between the products developed within a research context and their practical adoption. As elucidated by the valuable input provided by experts from Polito, there is a prevailing inclination towards favoring commercial tools over open-source alternatives, nevertheless this inclination does not solely stem from the factors elucidated in the preceding chapter but is also underpinned by a multitude of factors underscored by numerous surveys conducted in diverse research works. The findings obtained from a study examining decision-making processes in corporate environments have revealed significant insights that not only corroborate the observations made during the Politecnico encounter but also provide additional motivations for the widening gap between research products and their implementation in practice \cite{gap_paper}. For example, also this analysis underscores the impact of installation and setup requirements on analysts' decision-making regarding visualization tools, but furthermore, it provides additional insights such as personal constraints in certain environments that limit the adoption of alternative solutions outside of predefined corporate standards, as well as the impossibility of incorporating external solutions that could compromise corporate privacy.

A significant aspect that arises is the potential absence of privacy safeguards and security standards that guarantee the quality of open-source applications. Among the various options explored in this research, encompassing both available and unavailable tools, a single instance stands out where developers consistently provide status checks on the testing of their application, that is RedEye. This particular tool, developed not solely within a research context but by a group of researchers from CISA for a government-funded project, exemplifies the rarity of ongoing verification efforts. This observation is not merely based on the absence of evaluations, but it is also rooted in the lack of standardization within the research context, as previously anticipated in the exposition of the conducted theoretical research. This deficiency translates into a preference among stakeholders for established technical products that provide robust assurances. The absence of standardized evaluation frameworks contributes to the perception that open-source solutions may entail greater uncertainty and potentially lack the necessary guarantees to meet the rigorous demands of practical implementation. Consequently, this preference for established and trusted technical products perpetuates the gap between research endeavors and the adoption of solutions in real-world scenarios, hindering the integration of innovative open-source tools into practical security visualization practices.





