Having spent some time down this route, the big question is, who consumes these visuals, and what kind of decisions do they make, and how? I'm already heavily i

Having spent some time down this route, the big question is, who consumes these visuals, and what kind of decisions do they make, and how? I'm already heavily invested in this, and it's still possible I've just got it completely wrong and it sucks, but here's some insight on viz in the security field. For the last year I have been presenting a set of visual models that allow product managers (and people who hold solution risk but don't code) to collaborate on threat modelling with their dev teams, because collaboration is the only viable way to solve security, and it's the one thing we haven't tried because the entire DNA of our field originates in a revolt against solving problems merely by managing to get along with others. Product and higher love it, but the resistance I have encountered has been from security technologists whose work it simplifies because it does not enable them to express their virtuosity. The analogy I would use is it's has been a bit like showing a pianist a sequencer/synthesizer or a percussionist a turntable. Excellent tools for composition and making things other people want, but ones that debase the artists investment in talent and physical skill. It does not help them actualize. Security people become extra suspicious of data viz because they sense they are the ones being persuaded to trust the person who came up with it, and their mission in life is to dig beneath representations. Viz can have the opposite of its intended effect by reducing team alignment as the result of the most technical people defecting in response. What I have learned about colleagues in the security field is that they want tools to help them become things, not reports to relate with and broker things. Security people tend to want to be powerful outsiders, hackers, researchers & scientists, sheepdogs, magicians, etc. They generally do not want to be the insiders, deal makers, enthusiasts, collaborators, persuaders, deciders, or other people who operate on the level of abstraction where they consume and present visualizations and other representations. If we did, learning about crypto primitives and to reason in BAN logic is the least smart way to achieve that. Similarly, nobody masters the oboe to be cool and popular like a DJ, and while they appreciate the difference it makes in a song, most people are indifferent to whether it is synthesized. So long as a tool lets a project manager move a risk item from Red to Amber to get them through a project gate, they wouldn't care if we in security used an interpretive dance troupe. The threat modelling tools today are basically toys for technologists where decision makers see them and say, "great, you've shown us how smart you are, what will it take to get you onside?" The irony is that this is success from a security perspective, because it gets them a seat at the table. So why say this at all? Because the revolutionary change that will solve security will not come from data, or individuals demonstrating how brilliant they are. It will be a function of collaboration, facilitated by clear representations of shared understanding, and alignment of all parties on incentives and risks. That last part is the Hard problem, because it's fundamentally political, and the one as technologists we are least equipped to resolve. This data viz challenge is a fun idea, but it would be helpful to know just who they think will be the consumer of these visualizations, and what they would do if one were perfect.