Skip to main content

CASE STUDY · AI-ASSISTED THREAT INTELLIGENCE

Turning complex cybersecurity data into actionable threat intelligence

Turning complex cybersecurity data into actionable threat intelligence

Turning complex cybersecurity data into actionable threat intelligence

I designed Fortra’s Brand Protection AI-assisted experience—helping security teams identify their most prominent threats

I designed Fortra’s Brand Protection AI-assisted experience—helping security teams identify their most prominent threats

TL;DR

TL;DR

TL;DR

I know you’re busy. Here’s the entire project in 30 seconds.

01

PROBLEM — Customers needed a faster, more consumable way to understand large volumes of phishing data, especially high-frequency threats from the previous 30 days. They also needed concise page-level summaries so they could spend less time searching the information that mattered most.

PROBLEM — Customers needed a faster, more consumable way to understand large volumes of phishing data, especially high-frequency threats from the previous 30 days. They also needed concise page-level summaries so they could spend less time searching the information that mattered most.

02

MY ROLE — I led the UX design effort from user flows and wireframes through final mockups and handoff. I aligned with directors and product managers, spoke with sales about the customer need, and iterated with engineering across a 20-plus-screen build.

MY ROLE — I led the UX design effort from user flows and wireframes through final mockups and handoff. I aligned with directors and product managers, spoke with sales about the customer need, and iterated with engineering across a 20-plus-screen build.

03

SOLUTION + CONVERSION — We organized threats into Families and Actors, added geographic and trend views, and introduced AI summaries that surface the most important page information. A prospective customer loved the prototype and bought into the ongoing service: our primary conversion metric.

SOLUTION + CONVERSION — We organized threats into Families and Actors, added geographic and trend views, and introduced AI summaries that surface the most important page information. A prospective customer loved the prototype and bought into the ongoing service: our primary conversion metric.

ROLE

UX DESIGNER III

TIMELINE

12+ weeks

TEAM

Product leadership, Sales, Engineering, Design

SCOPE

AI summaries · Threat intelligence · Secure sale

01 · OVERVIEW

Making important information easier to find and understand

Making important information easier to find and understand

Fortra Brand Protection helps organizations detect and eliminate fraud and impersonation threats before they escalate. I designed the first phase of its AI-assisted experience alongside new Threat Family, Threat Actor, mapping, filtering, and data-visualization capabilities for security teams managing high volumes of complex information. This was based on a potential customer request to secure a sale.

02 · PROBLEM

The platform had the data—but users struggled to find actionable insight.

The platform had the data—but users struggled to find actionable insight.

For a security analyst triaging incoming threats, the platform’s biggest asset was also its biggest obstacle: too much data, not enough clarity on what mattered right now. An analyst reviewing several alerts a day needed to answer three questions fast — what changed, what’s happening most frequently, and what needs attention first — but the existing tables and workflows made them dig for every answer instead of surfacing it. Meanwhile, the growing feature list risked making the platform harder to use with every addition, not easier.

03 · PROCESS

Integrating Threat Family + Threat Actors Into Our Brand Protection Product

Integrating Threat Family + Threat Actors Into Our Brand Protection Product

To help customers make sense of large volumes of threat data, we introduced Threat Families and Threat Actors as a new way to organize and contextualize their most important threats.


  • Once we knew what the data actually was, recurring threats grouped by type, with specific sources behind them, the real design question wasn’t how to reorganize it, but how to name it in a way that made sense the moment someone read it. If a customer was constantly hit with phishing attempts from the same U.S. state, we needed language that could say that plainly: the Threat is phishing, and the Actor is where it’s coming from.

  • I worked through the taxonomy with PMs and data engineers: Family vs. Group vs. Category, Threat vs. Sub-threat, testing each option against how clearly it would read to someone scanning a page for the first time. UX language decisions like this were largely ours to make; product and engineering rarely pushed back on naming itself.


To help customers make sense of large volumes of threat data, we introduced Threat Families and Threat Actors as a new way to organize and contextualize their most important threats.


  • Once we knew what the data actually was — recurring threats grouped by type, with specific sources behind them — the real design question wasn’t how to reorganize it, but how to name it in a way that made sense the moment someone read it. If a customer was constantly hit with phishing attempts from the same U.S. state, we needed language that could say that plainly: the Threat is phishing, and the Actor is where it’s coming from.

  • I worked through the taxonomy with PMs and data engineers — Family vs. Group vs. Category, Threat vs. Sub-threat — testing each option against how clearly it would read to someone scanning a page for the first time. UX language decisions like this were largely ours to make; product and engineering rarely pushed back on naming itself.

04 · Pushback

04 · PUSHBACK

Finding the right amount of data

Where we did get pushback was on scope: what data should actually populate each Threat Family and Actor, and whether the entire page should filter to a rolling 30-day window only. We opted against locking the page to 30 days, a decision that shaped how the AI summary later needed to handle both recent activity and longer trends.


Where we did get pushback was on scope: what data should actually populate each Threat Family and Actor, and whether the entire page should filter to a rolling 30-day window only. We opted against locking the page to 30 days, a decision that shaped how the AI summary later needed to handle both recent activity and longer trends.

05 · AI INTEGRATION

AI needed to add clarity, not just automation.

To make threat information easier to digest at a glance, we introduced AI-generated summaries across Threat Family and Threat Actor pages. Once Threat Families and Actors gave the platform a clearer structure, the next question was how to keep that structure useful as new data came in constantly.

That’s where the AI summary came in, a running explanation that updates automatically as new threat data arrives, so analysts get the “what’s changed and why it matters” answer without re-reading every entry themselves.


To make threat information easier to digest at a glance, we introduced AI-generated summaries across Threat Family and Threat Actor pages. Once Threat Families and Actors gave the platform a clearer structure, the next question was how to keep that structure useful as new data came in constantly.

That’s where the AI summary came in — a running explanation that updates automatically as new threat data arrives, so analysts get the “what’s changed and why it matters” answer without re-reading every entry themselves.

Gif showing the loading state of an AI component

06 · OUTCOMES

The prototype secured the sale

The prototype secured the sale

A prospective private-sector customer responded enthusiastically to the new capabilities and purchased the ongoing service before the full production experience shipped. The work also established the first AI-assisted pattern within Brand Protection.

07 · REFLECTION

Clarity—not novelty—made the AI useful

Clarity—not novelty—made the AI useful

This project reinforced something I keep coming back to: AI creates value when it reduces the effort required to understand complex information, not when it adds more to look at. The strongest solution here wasn’t the page with the most data or the most features — it was the one that helped users recognize a pattern and decide where to focus in seconds, not minutes.

Need all hands on desk? Reach out

leahsymonne@gmail.com

Need all hands on desk? Reach out

leahsymonne@gmail.com

Need all hands on desk? Reach out

leahsymonne@gmail.com