# A Survey on Immersive Cyber Situational Awareness Systems
## 1 Introduction  
With the drastic increase in cybercrime, especially after the outbreak of the COVID-19 pandemic [1], cybersecurity awareness, education, and training have become imperative for every individual. The pandemic alone contributed to a 400% increase in cybercrime incidents [2], coinciding with the accelerated digitization of services and global commerce. For instance, global retail e-commerce sales were valued at USD 5.8 trillion in 2023 [3], are projected to exceed USD 6.3 trillion in 2024, and are expected to surpass USD 8 trillion by 2027, creating an expanded attack surface for malicious actors [4]. This rise in online activity has been matched by a corresponding increase in cyber threats. In 2022, the FBI'sInternet Crime Complaint Center reported USD 10.3 billion in losses from cybercrime, up from USD 6.9 billion in 2021, across 800,944 reported incidents [4]. The 2024 Data Breach Investigations Report by Verizon Business found ransomware responsible for 23% of all breaches in 2023, while phishing simulations showed that 20% of users identified malicious emails, with 11% of those who clicked also reporting the incident [5]. Similarly, the Sophos State of Ransomware 2024 reported that 59% of organizations faced ransomware attacks in 2023, down slightly from 66% in the preceding two years. Critically, human error remains a central contributor to security breaches. A growing body of research links many incidents to a lack of cybersecurity training and user awareness [6]. One analysis found that 99% of data security incidents reported to the UK Information Commissioner's Office were caused by human error, suggesting that such incidents are far more common than currently acknowledged by the cybersecurity community [7]. In response, the field of cyber situational awareness is gaining increasing attention from researchers, practitioners, and educators, as it seeks to address the human element of cybersecurity by enhancing individuals' real-time understanding of cyber threats and decision-making under uncertainty. Cyber situational awareness can be considered as an application of [PERSON]'s situational awareness reference model [8] in the cybersecurity domain [9]. Cyber situational awareness refers to the identification, collection, analysis, and evaluation of cybersecurity data from a given system to make effective decisions for responding to potential cyber threats [10]. Traditional cyber situational awareness systems provide perception, comprehension, and projection of cyber environments to end users through two-dimensional displays (e.g., 2D screens) with limited interaction capabilities (e.g., mouse, keyboard, and monitor). These conventional visualization and interaction technologies limit users' cognition and understanding of cyber situations, which eventually deteriorates cyber situational awareness. For example, cybersecurity data complexities (e.g., fast, dynamic, and unpredictable data) and heterogeneity lead to data occlusion and convolution in traditional cybersecurity visualizations [11], which limits the perception of cyber situations [12, 13]. Moreover, users suffer from mental effort and cognitive load when they need to shift their focus between multiple terminal windows to understand cyber situations and perform parallel activities through traditional visualization and interaction techniques of cyber situational awareness systems [14]. This issue was spotlighted during the surge of the COVID-19 pandemic when operators needed to monitor pandemic-related data and respond to cybersecurity alerts simultaneously [15]. To solve the abovementioned problems, immersive technologies based on extended reality are used to create effective cyber situational awareness for end-users [16, 17, 18]. Immersive cyber situational awareness systems refer to software and hardware systems that allow users to replace or expand their physical environments with virtual objects to create perception, comprehension, and projection of cybersecurity-relevant information within a system.