Context

I joined BlueVoyant as Director, Product Design with a mandate to create agency for design — the standing, process, and infrastructure for design to operate as a structural partner, not a vendor of screens.

The company was an MSP evolving through digital transformation: services needed to become products that let customers self-serve, automate workflows, and understand what BlueVoyant was doing on their behalf without calling an operator. Growth had been organic and through acquisition — Managed Sentinel, Concanon, Group202, etc. — and each addition brought its own tooling, conventions, and customer-facing surfaces.

What already existed was a client portal shaped by business requirements and customer requests, not a unified product vision:

• Dashboards with mislabeled metrics, disorganized charts, and no customization for the insights customers actually needed
• Security events and incident escalations that showed operator activity without trustworthy, actionable context
• Managed asset and vulnerability inventories that were out of date or failed to sync correctly
• Assessments based on outdated cybersecurity frameworks — certification without a path to improvement
• Reports that exported the dashboard as a PDF rather than answering executive questions

Concurrently, MDR (Managed Security), SCD (Supply Chain Defense / managed risk), and DRP (Digital Risk Protection) were being packaged and sold by separate teams — disconnected customer operations and disjointed experiences. Leadership’s vision was clear: unify the disparity, avoid redundant feature work, reduce technical debt, and improve quality. My job was to make that vision buildable.

The Legacy Portal

UX evaluation of the existing MDR portal surfaced the gap between customer expectations and what the product delivered. The slides below document scores and structured feedback from that review — utility and aesthetics could score moderately while workflow value still failed.

The Demisto contract reaching end-of-life acted as a forcing function: migrating off the platform required deliberate, cross-product thinking the organization wasn’t natively structured for. Partnering with deployment, product, engineering, and services, I mapped out existing workflows and data intersections. This defined exactly what needed to be built natively versus integrated externally. The outcome was a clear architectural roadmap for the unified portal that successfully aligned stakeholders across the business.

Customer Research

Research ran through interviews, usability testing, surveys, and design workshops — partnering with client account teams and the operators who delivered services daily. A formal MDR survey with 50 customers (CISOs and SOC teams) quantified priorities: onboarding and deployment tracking, daily service digests, incident escalation paths, and risk-based reporting — with 60% ranking reports as must-have.

The qualitative themes behind those numbers were consistent across solutions:

• We feel protected — but what are you doing for us continually?
• We know you run SOC duties — how are you actually performing?
• Why does your data differ from ours?
• We have control gaps — how do we improve hygiene and posture?
• How do I prove to executives this service is working — what’s covered, what’s our SLA, what else should we buy?

Those questions became the backlog for unified reporting, trustworthy data surfaces, workflow-oriented alerts, and a portal shell that could eventually answer coverage and package questions across MDR, SCD, and DRP.

The operating model — shared researcher, cross-functional rituals, dual-track discovery and delivery — and the design system with Product UI Guidelines — tokens, semantic color, dashboard templates — are documented in the pattern studies. Here they matter as prerequisites: research without a system to implement against stalls; a system without customer voice doesn’t survive PM prioritization.

Portal Unification — What Shipped

The unified portal launched as a navigation layer first: single authentication across MDR, SCD, and DRP with a consistent shell, header, and navigation — getting customers into one place before merging workflows inside it.

Within MDR, we shipped substantial ticket management and incident workflow updates — the primary day-to-day surface for SOC analysts and customer security teams. The data grid was rebuilt with consistent sorting, filtering, and bulk actions to handle security event and incident dispositions more efficiently. Onboarding was redesigned for faster time-to-value on new deployments. Report generation moved into a unified framework for exporting MDR, risk, and exposure data together.

Cross-product workflows — connecting a supply-chain risk finding to an active MDR incident, or a DRP credential exposure to monitored endpoints — were designed and partially prototyped. Endpoint intersection between MDR and DRP was underway at the end of my tenure. Full workflow unification remained a multi-year arc; the shell and MDR improvements were the credible first layer.

Outcome

42% faster mean time to respond came from MDR workflow changes — ticket management redesign, incident queue architecture, and less context-switching between Demisto, the legacy portal, and external SIEM tools.

Fortune 500 adoption reflected financial-sector clients expanding from MDR into newer risk products. A portal that presented all three lines coherently — even before workflows fully merged — made that expansion conversation credible.

Brand and visual identity unification, the design team’s charter, and DesignOps to maintain the system were part of the same transformation — detailed in One Source, Every Surface. The longer arc — genuine data and workflow unification across product lines — needed the foundation this work put in place: customer voice, shared infrastructure, and design with agency to keep building.