User Challenges

• Analysts faced information overload with scattered alerts, logs, and indicators spread across tools.
• Critical insights were buried under repetitive or false alerts, increasing investigation time.
• Decision fatigue caused delayed response and inconsistent triage quality.

Systemic Challenges:

• Security leaders lacked a unified view to assess risk posture across departments.
• Fragmented workflows made it difficult to scale or audit response efforts.
• Existing tools were technically dense, creating a steep learning curve for new users.

To uncover real-world context, we conducted stakeholder discussions and heuristic audits across SOC teams.

• User Research: Shadowed security analysts to understand how they investigate incidents and where friction arises.
• Gap Analysis: Mapped redundant tool overlaps and cognitive load triggers within the investigation flow.
• Persona Definition: Defined two key personas:  the SOC Analyst (fast, detailed, needs clarity) and CISO (strategic, high-level, needs assurance)
• Feature Prioritization: With BinaryFlux teams, we prioritized visual intelligence, contextual linking, and automation of routine tasks.

The design evolved into a clean, intelligence-first interface that made complex investigations visual and intuitive.

• Threat Graph Visualization: A GNN-powered map connecting entities (devices, users, events) to highlight relationships and attack paths.
• Unified Triage Console: Combined alert feed, entity details, and investigation context within one workspace—minimizing tab hopping.
• Priority Scoring System: Severity-based visual indicators to help analysts focus on what matters first.
• Action Shortcuts: Quick “respond,” “isolate,” and “escalate” actions built directly into the alert feed.
• Dark Themed UI: A functional and immersive environment optimized for long analyst hours and high cognitive focus.