One design system across three security products
Exabeam's traction came from Advanced Analytics, a machine-learning behavioral analytics tool. The logs product was in its infancy and Incident Response hadn't shipped. Together the three formed a SIEM platform — and they didn't look or behave like one product.
I joined as the first product design lead, as the team began introducing a scalable pattern library and platform-wide journey maps to close the gaps. The goal was a design system consistent across every product and flow, and extensible according to the principles we'd set.
In addition to primary research by meeting with customers, we did solution research and audited the existing platform for accumulated user feedback.
Feedback from support tickets, CS calls and interviews was sorted into "how might we" columns and voted on by the team, so a quarter's roadmap started from what analysts had already told us was hard — restarting a data pipeline, managing certificates, reading the risk chart, understanding what the models were doing.
Affinity board — feedback sorted into how-might-we columns
Advanced Analytics scored risk by comparing a user or asset against its peers — people in the same role, machines in the same zone. The grouping was computed, not configured, and it changed as behavior changed. That made the scores accurate and the interface opaque: an analyst saw a number and no way to ask which peers it was measured against.
We dug into user needs and identified what data the UI would need to support, and answered how the UI would adapt and scale across varying data sets and customers.
Asset header — peer group surfaced on expand
Peer group became a first-class field in the entity header rather than a setting buried elsewhere, and risk reasons were written to name the comparison in plain language — "access to 519 assets, expected around 6 for group IT" instead of a bare score contribution.
The collapsed header keeps the score and the top connections; expanding reveals peer group, first seen, last seen and last location. An analyst under pressure gets the number first and the reasoning on demand.
Risk reasons naming the peer-group comparison
The most transferable work here was the chart system. Deciding how to label axes, when a legend earns its space, what a tooltip owes the reader, and how a view holds up at different zoom levels over time — that is where a security product either becomes readable under pressure or doesn't.