## 2 Background  
Cybersecurity issues related to user experience have been explored in human-computer interaction (HCI). For example, risks involved in smartphone usage at the workplace [18], users' privacy violations via activity tracking technologies [19; 20], and challenges associated with wearable devices [21] are all closely related to how users interact with their devices and applications. Moreover, cybersecurity awareness has been widely discussed by both HCI and information science researchers from socio-user perspectives [22; 23; 24]. Research in this domain often focuses on how humans can protect an organization's information systems through behavioral management and education. However, we argue that educating and training end-users in individual layer-wise security vulnerabilities (for example, risks/vulnerabilities associated with smartphones, gateways, or user experience  
Figure 1: IoT-Health scenario for Table-top exercise.  
in using devices) is inadequate for providing users with a real-time view of the overall security status of a system [3]. Instead, information on security properties of step-wise data propagation is crucial in identifying any potential weaknesses and high-security risks in the system [9; 12]. Thus, it is vital to provide such information to enable human end-users to understand and analyze it.  
Healthcare data are particularly sensitive; even minor inaccuracies can pose serious risks to patients, potentially resulting in fatal outcomes. Moreover, the expansive attack surface in remote healthcare monitoring and telehealth architectures makes this issue even more critical [25]. Researchers indicated gaps in situational awareness for cybersecurity and urged for more focused research in this vital area [26]. To support end-users in making correct decisions about the reliability of the available data, we need to establish run-time analysis of the security status for processes and devices in these systems.  
Provenance has been studied widely in the past in archival science to identify the authenticity of manuscripts, financial reports, patient logs, etc. [27; 28]. The provenance of a data item includes information about the processing steps and source data items that lead to its creation and current representation. Inspired by provenance-based models [29; 30], the Prov-IoT model [15] presents a security-aware provenance graph that includes security-relevant information by the need of the end-user to see not only the actual processing steps but also the layer-wise security status in the IoT application. Although the Prov-IoT fundamentally motivates the need for adding run-time security metadata to provenance graphs, an analysis of what security information is available in current systems, what can potentially be made available, as well as the human perception and ability to process this security metadata remains open.  
While end-users may be empowered with certain training programs and information security awareness education, in the multi-layer decision-oriented IoT system, it is necessary to understand what kind of security information and situational evidence can be used for understanding the current risks for manipulations and attacks potentially corrupting data and changing system behavior. These run-time security metadata need to be propagated through the system layers and visualized to end-users to empower them with the overall system's exact security and situational status. To the best of our knowledge, this study is the first to consider this research agenda in empowering end-users for cybersecurity situational awareness by considering step-wise security status and relevant information.