Empowering Novice Security Analysts

I worked with Cisco’s Security team to rethink how novice security analysts investigate and respond to cyber threats.

Through extensive user research, journey mapping, and cross-functional workshops, we designed a more intuitive experience that brought a fragmented workflow into one place.

Along the way, we learned that some conventional UX best practices don’t necessarily apply to cybersecurity. Analysts wanted less dashboard and more data.

The work ultimately contributed to Cisco’s new XDR platform, unveiled at RSA Conference in 2023.

The security industry is woefully understaffed. Global cybersecurity job vacancies grew by 350 percent, from one million openings in 2013 to 3.5 million in 2021, according to Cybersecurity Ventures. 750,000 of those jobs are in the US (Statista).

Faced with a challenge like that, there are two options — train literally millions of people in the complex world of cyber security, or, multiply the impact that existing SOCs (Security Operation Centers) have. In reality, we need both, but Cisco was focused on the latter.

The project aimed to develop an extensible XDR (Extended Detection and Response) tool tailored to assist novice SOC (Security Operations Center) analysts in reducing their time to detection and response. By employing risk-based prioritization, the tool ensured analysts focused on critical incidents. Additionally, it provided the essential information necessary for analysts to respond confidently. Throughout the engagement, we established design patterns and principles specific to the SOC persona, which were translated into a user-validated prototype. This presentation encapsulates the design journey that culminated in the creation of the prototype and associated artifacts.

Security analysts have a complicated job. Making matters worse, Cisco’s existing tools were a loosely connected collection of products, each addressing different parts of the incident response process.

What should have been a relatively straightforward workflow involved jumping between applications, copying information, and keeping track of work across multiple screens.

To make sense of this, we conducted extensive research with security analysts, which we consolidated into the largest journey map I’ve ever seen.

It helped us understand not just what analysts needed, but when they needed it, and where the biggest opportunities for improvement were.

Armed with our research, we brought together stakeholders and security experts from across Cisco for a concepting workshop.

We started by walking everyone through the analyst’s workflow, establishing a shared understanding of the problem. From there, we invited participants to sketch ideas and explore solutions.

The workshop surfaced perspectives from across roles, functions, and product teams, helping us build alignment around a new direction.

Our first concept was built around a simple idea: organize the product around the analyst’s workflow, rather than Cisco’s portfolio of tools.

We designed a tab-based experience that moved naturally from detection to investigation and response.

Rather than jumping between applications, analysts could work through an incident from left to right, with the information and tools they needed in one place.

Early testing was encouraging. Analysts appreciated having the different parts of their workflow brought together.

As designers, we love a good dashboard. Big numbers, charts, graphs. A beautiful overview of everything happening in a system.

But our research revealed that the analysts we were designing for couldn’t care less.

Sure, a manager or CISO might want to see how the organization is performing. But an analyst sitting down to start their shift wants to know one thing: What needs my attention right now?

Designers have a tendency to simplify. We remove information, create white space, and try to make things feel light and airy.

But sometimes, we’re solving a problem that doesn’t exist.

Security analysts spend their days digging through data. They’re comfortable with dense interfaces, and they want useful information as quickly as possible.

After rounds of concepting, user testing, and iteration, we delivered a high-fidelity, clickable Figma prototype.

The final experience brought together incident detection, investigation, and response in a single, workflow-driven interface.

Cisco incorporated substantial portions of our work into XDR, which it unveiled at RSA Conference in April 2023.

You can check out the marketing site for the product here, or walk through the public demo here.