CYFOXMaking security operations easier to see, investigate and act on.
A UX redesign of an enterprise cybersecurity platform spanning threat visibility, endpoint assets, forensic events, mitigations and administration.
The work focused on bringing multiple security capabilities into a more coherent operations experience. The supplied archive includes earlier module screens and a redesigned interface set, allowing the case study to examine how navigation, dashboard hierarchy, data tables and operational actions are structured.
Scope note: The date shown is the broader Softobiz employment period associated with CYFOX in the supplied career context. The exact CYFOX project start/end dates, team composition and release status were not provided in the uploaded archive.
01 / EXECUTIVE SUMMARY
The story in STAR format.
A hiring manager should understand the product challenge, your responsibility, your decisions and the visible deliverables before exploring the detailed UX process.
S / SITUATION
Multiple security capabilities
CYFOX covered endpoint and security operations areas including EDR, event management, file integrity, network access, vulnerability visibility and asset protection.
T / TASK
Create a coherent operations experience
Organize security information and operational tasks so users can understand risk, review activity, inspect assets and access mitigation and administration tools.
A / ACTION
Restructure the product interface
Work across information hierarchy, navigation, overview dashboard, asset tables, forensic events, mitigation records, settings and user-management surfaces.
R / RESULT
Redesigned UI set
The supplied redesign includes a consolidated overview, structured sidebar navigation and dedicated screens for assets, forensics, mitigations, system settings and users.
Evidence boundary: The archive proves the existence of the legacy and redesigned screens. It does not include interview notes, usability-test reports, stakeholder sign-off, launch records or outcome metrics. Results are therefore described as designed deliverables, not measured business impact.
02 / PRODUCT CONTEXT
Security teams need clarity under pressure.
Security operations interfaces bring together many kinds of information: endpoints, events, severity, investigation context, configuration and response actions. The design challenge is to help users move between those views without losing the operational thread.
PRODUCT COMPLEXITY
Multiple modules, one security environment
The legacy archive shows separate surfaces for EDR, Event Manager, FIM, NAC, vulnerabilities, weak passwords, cloud and security wall-style monitoring. Each view represents a different part of the security picture.
UX COMPLEXITY
From seeing risk to taking action
The redesigned set makes threat overview, endpoint assets, forensic events and mitigations distinct destinations, while keeping them within one persistent product navigation model.
OBSERVATION 01
Module fragmentation
Legacy screens expose different security modules and data views. A user may need to move between these areas to build an operational picture.
Visible in legacy screensOBSERVATION 02
Dense security data
Tables, event descriptions, endpoint records and configuration details require scanning, filtering and comparison.
Visible in legacy and new screensOBSERVATION 03
Risk needs hierarchy
The redesigned overview gives prominent space to attack activity, GIOC events, endpoint license and severity distribution.
Visible in redesigned overviewOBSERVATION 04
Operational actions need context
The redesigned Assets screen places multi-select actions—Isolate, Release and Manage Subscriptions—near the selected asset set.
Interpretation: The screenshots support an interface redesign narrative. They do not, by themselves, prove that the older design caused specific user errors or measurable delays. Those would require research or operational data.
03 / PRODUCT SCOPE
Prioritize the work with MoSCoW.
MoSCoW helps focus a complex platform redesign around the capabilities required for daily security operations, while separating supporting enhancements from longer-term ideas.
MUST HAVE
Operational essentials
Security overview dashboard
Asset inventory and status
Forensic event visibility
Mitigation status and actions
Clear product navigation
Without these, users cannot orient themselves, inspect endpoint context or follow security actions.
SHOULD HAVE
Efficiency and control
Search, filters and refresh
Sorting and pagination
Bulk asset selection/actions
User management
System and policy settings
These capabilities support repeated operational and administrative tasks across the platform.
COULD HAVE
Workflow accelerators
Saved filter views
Custom dashboard layouts
Richer alert drill-down
Bulk action confirmation patterns
Contextual help and guidance
Potential enhancements to investigate after the core inventory, triage and mitigation workflows are dependable.
WON'T HAVE · PROPOSED V1
Out of initial focus
Social collaboration feed
Unrelated productivity modules
Decorative data visualizations
Unvalidated predictive features
Proposed non-goals to protect the security-operations focus; not recorded as an approved stakeholder decision.
MoSCoW status: This prioritization is reconstructed from the uploaded screens and visible product capabilities. It is a portfolio explanation of how I would frame scope; it is not claimed to be the original approved backlog or workshop decision.
04 / RESEARCH & SYNTHESIS
Understand workflows before choosing layouts.
The available evidence supports a structured interface audit and task analysis. The archive does not contain raw user interviews, participant profiles or test results, so the research approach is presented honestly as an audit and a validation framework—not as completed user research.
01 / INTERFACE AUDIT
Inventory existing modules
Review the legacy EDR, Event Manager, FIM, NAC, Vulnerability, Weak Passwords, Cloud and monitoring screens to understand the information domains and repeated UI patterns.
02 / TASK ANALYSIS
Map operational intent
Identify the major jobs visible in the redesigned product: monitor security posture, inspect assets, review forensic events, track mitigation state and administer users/settings.
03 / DESIGN SYNTHESIS
Translate observations into design priorities
Group the interface needs around orientation, risk visibility, data inspection, bulk action, configuration and support.
Observed UI evidence
UX interpretation
Design opportunity
Confidence
Legacy archive includes multiple independent security module screens.
Security functions are represented through distinct module-specific views.
Provide a more consistent navigation shell and clearer grouping of product areas.
Visible in archive
New overview combines attacks, GIOC events, endpoint licensing, severity and MITRE ATT&CK.
Different security signals need to be understood together at a glance.
Use dashboard hierarchy to surface urgent signals and supporting context.
Visible in archive
Assets table includes risk score, management, OS, status and row actions.
Asset review needs comparable fields and clear operational state.
Use a consistent table structure, status labels, sort controls and contextual actions.
Visible in archive
Assets selected state exposes Isolate, Release and Manage Subscriptions.
Users may need to act on one or multiple selected endpoints.
Make selection count and available bulk actions explicit.
Visible in archive
Forensics and Mitigations have separate event-oriented tables.
Investigation evidence and response tracking are related but different tasks.
Keep the two destinations distinct while maintaining consistent table behaviors.
Visible in archive
Research required to make this fully evidence-led: SOC analyst and security administrator interviews; task observation; incident-triage walkthroughs; terminology checks; current-workflow mapping; and usability tests of the redesigned overview, asset selection and mitigation flows. Add actual sample size, participant roles, findings and anonymized quotes only if those records exist.
05 / USERS & JTBD
Design for the jobs security teams perform.
The screens suggest several task types. These are proto-personas based on the interface and common security-operation responsibilities—not validated user segments or research personas.
PROTO-PERSONA 01MONITOR & TRIAGE
SOC Analyst
Primary job: understand threats and prioritize investigation.
“Show me what needs attention first, and let me get from an alert to the related evidence.”
JTBD
When security activity changes, help me see severity and investigate the relevant event quickly.
Potential friction
Too many metrics, unclear severity, disconnected event and asset context.
Design opportunity
Prioritized overview, readable GIOC events, risk and severity indicators, direct drill-down.
PROTO-PERSONA 02INVESTIGATE & RESPOND
Security Administrator
Primary job: inspect endpoint state and coordinate response.
“Help me identify the right endpoint, understand its state and apply the appropriate action.”
JTBD
When an asset is at risk, help me inspect its context and track containment or mitigation.
Potential friction
Unclear asset identity, inconsistent status labels, risky bulk actions.
Design opportunity
Asset inventory, explicit status, selection controls and visible action bar.
PROTO-PERSONA 03CONFIGURE & GOVERN
Platform Administrator
Primary job: maintain system, user and group configuration.
“Let me manage access and settings without losing the structure of the security platform.”
JTBD
When the environment changes, help me manage users, groups and system configuration consistently.
Potential friction
Scattered settings, unclear ownership and difficult-to-scan user records.
Design opportunity
Grouped configuration navigation, user table, add/import/export and structured settings.
Treat these as starting hypotheses. Validate role boundaries, permissions, language and task frequency with actual SOC analysts, endpoint operators and platform administrators.
06 / USER JOURNEY MAP
From alert to action without losing context.
This journey models a common security-operations task: monitor posture, detect an issue, investigate the event, inspect the affected endpoint, take a mitigation action and confirm the state. Validate the stages and sentiment with real operational users.
Stage
01 · MONITOR
02 · DETECT
03 · INVESTIGATE
04 · ASSESS
05 · RESPOND
06 · VERIFY
User goal
Understand current security posture.
Identify activity needing attention.
Understand event details and context.
Identify affected endpoint and risk.
Apply the appropriate mitigation.
Confirm current state and keep a record.
User action
Scan attack, endpoint and severity overview.
Review new attacks and GIOC events.
Open Forensics and inspect event details.
Search/filter Assets and review risk/status.
Select endpoint and use available action.
Review mitigation record and endpoint state.
Potential friction
Important signals compete for attention.
Severity may be unclear without context.
Large event lists are hard to scan.
Host identity and state may be fragmented.
Bulk action risk or ambiguous confirmation.
Unclear whether action is complete.
Design opportunity
Prioritized dashboard and clear hierarchy.
Severity and recency cues.
Readable event tables and filters.
Consistent asset attributes and status.
Explicit selection and action feedback.
Consistent state and audit visibility.
Screen evidence
Overview
Overview / New Attacks
Forensics
Assets
Assets selected / Mitigations
Mitigations
Validation question
Can users identify top priorities?
Can they interpret severity correctly?
Can they find relevant event details?
Can they identify the correct host?
Can they act with confidence?
Can they verify the final state?
This is a task-based journey hypothesis derived from the interface. It is not a record of measured user emotions, task duration or observed pain-point frequency.
07 / INFORMATION ARCHITECTURE
Give a complex platform a predictable structure.
The redesigned navigation groups the platform into operational domains. This helps users build a mental model for where monitoring, protection, configuration and support tasks live.
CYFOX / IA reconstructed from redesigned navigation
CYFOX · SECURITY OPERATIONS
01 · Analytics
Overview
Attack Hunter
Forensics
Reports
02 · Protection
Assets
Users (shown in user view)
Downloads
Mitigations
03 · Configuration
Policy
Group Management
Settings
04 · Support & global
Help
Search
Notifications
Account / organization
IA evidence: The group labels and destinations are read from the redesigned sidebar. Users appears in the supplied Users screen; exact nesting or role-specific visibility should be confirmed against the live product.
08 / USER FLOWS
Connect monitoring, investigation and response.
The redesigned screens support three key task paths. The flows below show the intended sequence and the decision points that need to be clear to users.
Flow A / Triage a security signalMONITOR → INVESTIGATE
STARTOverview
Scan attacks, GIOC and severity.
→
IDENTIFYChoose signal
Review new attack or event.
→
INVESTIGATEForensics
Inspect host, time, engine and description.
→
ASSESSOpen asset
Understand risk and endpoint state.
→
DECIDEMitigation
Choose next operational action.
Key decision to validate: does the overview provide enough context to select the right event, and can the user reach the matching asset without losing their place?
Flow B / Select and manage endpointsASSET OPERATIONS
STARTAssets
View all or isolated agents.
→
FINDSearch / filter
Locate endpoint records.
→
SELECTSelect rows
Review selection count.
→
ACTIONIsolate / Release
Use available bulk action.
→
VERIFYCheck status
Confirm resulting endpoint state.
Risk control to validate: selection scope, action confirmation, permission checks, success/error feedback and undo/reversal behavior where applicable.
Flow C / Manage users and configurationADMINISTRATION
A dense dashboard can overwhelm; establish hierarchy and allow meaningful drill-down.
Severity is both color and label
Risk needs fast recognition without relying on color alone.
Use color alongside explicit labels such as Low, Medium, High and Critical.
Validate contrast, color-blind readability and consistent semantic use.
Data tables for operational records
Users need to scan, compare and find hosts/events.
Use clear columns, sorting, search, filters, pagination and row actions.
Balance information density with readability, responsive behavior and column priority.
Bulk actions beside selection
Users may need to isolate or release multiple agents.
Expose selected-row count and actions in a dedicated action bar.
High-impact actions require permission, confirmation, clear scope and feedback.
Dedicated Forensics and Mitigations views
Evidence review and response tracking are related but distinct.
Give each task a focused table while keeping shared navigation and table conventions.
Ensure users can move between related records without losing context.
Separate user and system administration
Operational platform setup needs a distinct information area.
Provide user records, add/import/export actions and grouped system settings.
Validate permissions, governance, empty states and error recovery.
10 / REDESIGNED EXPERIENCE
From module screens to connected operations.
The redesigned screen set introduces a unified application shell and gives major tasks their own focused surfaces. These are the actual screens supplied in the archive.
01 / Security operations overviewOrient · prioritize · drill down
The overview brings several security signals together: a new-attacks strip, total attack trend, GIOC event list, endpoint license distribution, MITRE ATT&CK matrix and endpoint severity distribution. The values visible in this screenshot are dashboard content—not evidence of design impact.
The asset table exposes comparable host attributes. The selected state makes the number of selected records visible and brings actions into a dedicated toolbar. This is especially important for actions that can affect endpoint connectivity.
Forensics focuses on event context—host, time, engine and description. Mitigations focuses on response records and state. The information architecture keeps those tasks separate while the visual language remains consistent.
06 / User managementIdentity · group · administration07 / System settingsConfigure platform behavior
Administration is treated as a distinct task area, with user search, import/export, filters and add-user affordance. System settings use grouped configuration panels rather than mixing setup controls into the monitoring dashboard.
11 / LEGACY INTERFACE AUDIT
Understand the starting point without rewriting history.
The legacy archive is valuable because it shows the breadth of the product before the redesigned screen set. It demonstrates the different security domains CYFOX needed to support.
Comparison integrity: This gallery documents the legacy screens supplied in the archive. It does not claim that every legacy module was removed or that the redesigned pages are one-to-one replacements. The exact migration and module-retirement plan was not included.
12 / DESIGN SYSTEM THINKING
Make complex data consistent and scannable.
The redesigned screens share a visual language across dashboards, tables and configuration forms. The design-system story should explain the reusable rules behind that consistency.
01 / COLOR SEMANTICS
Neutral surfaces + risk signals
Observed visual direction: dark neutral surfaces, light text, red critical/threat emphasis and distinct amber, blue and green status colors. Exact token values should be confirmed from the source Figma file.
02 / TYPE HIERARCHY
Aa 123 %
Title · metric · metadata
Dashboard headings, large metric values, table headers and supporting labels need distinct levels so users can scan from overview to detail.
03 / SPACING RHYTHM
Consistent density
Use repeatable spacing, card padding, table row height and alignment to balance information density with readability.
Component family
Variants / states
Behavior contract
Evidence in screens
Application shell
Expanded / collapsed sidebar · active nav · global actions
Keep location, navigation and global utilities consistent.
All redesigned screens
KPI / metric card
Default · trend · loading · unavailable
Show metric, timeframe/context and trend without ambiguity.
Overview
Severity indicator
Low · Medium · High · Critical
Use color with text/icon labels; never rely on hue alone.
Overview / Assets
Data table
Default · sorted · selected · empty · loading
Support scanning, sort, pagination, row actions and stable columns.
System ownership boundary: Screens show a consistent visual language and repeatable patterns. They do not prove a production Figma library, coded React component package, Storybook documentation, design-token export or versioning process. Add those artifacts only if you personally owned or contributed to them.
13 / ACCESSIBILITY & QUALITY
Make security data usable for everyone.
Security dashboards are high-density and status-heavy. Accessibility is not a finishing touch; it is part of helping users correctly interpret severity, locate information and take safe actions.
VISUAL ACCESSIBILITY
Color is never the only signal
Pair severity colors with text labels and icons. Confirm contrast for body text, muted metadata, status chips, charts and focus indicators.
OPERATIONAL ACCESSIBILITY
Make high-impact actions deliberate
Ensure selection state is explicit, keyboard focus is visible, actions are announced clearly and risky operations have confirmation and feedback.
DATA TABLE ACCESSIBILITY
Preserve structure and context
Use semantic table headers, readable labels, keyboard-accessible sort controls and predictable focus behavior across pagination and row actions.
RESPONSIVE QUALITY
Protect task priority on smaller screens
Define column priority, horizontal table behavior, card stacking and access to global navigation. The uploaded archive does not show mobile layouts, so responsive behavior must be confirmed.
These are design and QA requirements. The supplied screens do not prove formal WCAG testing or responsive implementation. Do not claim conformance until the implemented product has been evaluated.
14 / VALIDATION PLAN
Test the decisions that carry the most risk.
The redesigned interface should be evaluated using realistic security-operations tasks. The following is a validation plan, not a report of completed usability tests.
Scenario
What to observe
Success signal
Priority
Identify highest-priority threat
Can an analyst interpret dashboard hierarchy, timeframe and severity?
Correctly identifies the most urgent item and explains why.
Critical
Investigate an event
Can the user find the relevant event by host, time, engine or description?
Locates the correct record without avoidable navigation loops.
Critical
Find an endpoint
Can the user use search, filters, sorting and status labels?
Identifies the intended endpoint confidently.
Critical
Isolate or release agents
Does the user understand selection scope, action consequences and status feedback?
Performs the intended action with no scope ambiguity.
Critical
Review mitigation state
Can the user distinguish event, status, state and next action?
Correctly interprets whether the response is complete or pending.
High
Manage a user
Can the administrator add/find a user and understand group association?
Completes the task and understands the resulting access state.
High
Measurement plan: Establish baseline task completion, time on task, wrong turns, selection errors, action reversals, severity interpretation accuracy and confidence. Define targets only after a baseline is collected. No test scores or improvement percentages are available in the supplied archive.
15 / CONTRIBUTION & REFLECTION
What the redesign brought together.
The defensible result is a redesigned set of security-operations surfaces with a consistent navigation shell and focused destinations for monitoring, assets, investigation, mitigation and administration.
MY DESIGN CONTRIBUTION
From fragmented modules to structured operations.
Product and workflow understanding
Reviewed the breadth of legacy security modules and the tasks represented in the redesigned screen set.
Information architecture
Structured navigation around Analytics, Protection, Configuration and Support areas visible in the redesign.
Dashboard hierarchy
Organized attack activity, GIOC events, endpoint licensing, MITRE ATT&CK and severity information into an overview surface.
Operational data experiences
Designed or contributed to focused asset, forensic, mitigation and user-management table views.
Action clarity
Made multi-select asset actions and system configuration surfaces explicit in the UI set.
Consistency
Used a shared visual language across dashboard, data-table and administration screens.
What I would take into the next iteration
In cybersecurity UX, clarity is operational safety. A user must understand the signal, identify the correct asset, understand the consequence of an action and verify the resulting state. The next design cycle should focus on testing those high-impact moments with SOC analysts and administrators, then formalizing the reusable components and interaction states that support them.
Impact integrity: The dashboard contains values such as 650 attacks, 120,000 endpoints and severity counts. These are values displayed in the provided UI screenshot; they are not outcome metrics from the redesign. No adoption, time-saving, MTTR, alert-resolution or usability improvement data was supplied.
