## 6 Discussion
### Empowering End-Users with Cybersecurity Situational Awareness  
Users often do not have any information on many security mechanisms and controls already in use and that security metadata can, in principle, be added while designing security-aware provenance graphs of a system, while the use of HTTPS as security metadata are visualized in browsers, this is not the case in many other applications. Furthermore, end-users are often not informed about the use of encryption mechanisms, digital signatures, key management, 2 FA, MFA, TLS modes and parameters and/or OS versions, device configurations, protocols or flags used, anti-malware software, policies/specifications that were identified as security metadata in the exercises (details are included in Table 2). These pieces of information, for instance, having 2 FA or MFA in a system or generating encrypted data versus plaintexts, provide an understanding of the system risk/trust and help end-users make appropriate risk estimations and decisions while using the system. To illustrate, if an end-user (for example, a health practitioner) is informed of having 'MFA' based user login system, which is protected with'restricted key management' and'secure attestation', he might not question the data integrity or system authentication. Thus, heshould be able to proceed with their further medical treatment without any worry of thinking whether there is a data manipulation or incorrect authentication. In this way, the list of security metadata identified by this study would be helpful in empowering end-users with cybersecurity situational awareness. Moreover, researchers talked about software versions while discussing users' security awareness and indicated outdated versions as 'not recommended' [37]. During table-top exercises, experts discussed software versions and update status as potential security metadata. Accordingly, our study adds valuable recommendations for users' situational awareness.  
The effectiveness of security awareness and behavior training has been discussed by various researchers [23, 37, 38, 39]. During the table-top exercises, some experts raised concerns regarding end-users understanding of security metadata and situational awareness. We strongly believe that targeted training is crucial for enhancing users' understanding of visualized security metadata. For maximum effectiveness, it is vital that this security metadata are integrated into system visualizations in a clear and accessible manner. By doing so, end users will be empowered to draw accurate conclusions and make informed decisions based on the information they see. This study, therefore, aims to complement existing cybersecurity awareness initiatives, ultimately fostering a more effective and reliable architectural framework for users. Finally, we understand that the true effectiveness of security metadata for enhancing situational awareness cannot be fully exercised without feedback from non-expert users. Testing the usability of clinicians, patients, or administrative personnel would enable the authors to assess the intelligibility of the metadata, determine whether it can aid in decision-making, and evaluate its impact on trust and behavior. Therefore, we raise the importance of performing a usability study with non-expert users and keep it as a future work.