Velocity · Cybersecurity · 2021

Turning security noise into a clear next move

Velocity is a cybersecurity platform for detecting and responding to threats. This case focuses on the main security dashboard: the overview analysts use to understand security health, top alerts, entities at risk, recommendations, and recent activity.

I led the dashboard design from research synthesis and wireframes to user flows, visual design, dev handoff, and build support. The core problem was noise: teams had many signals but no clear next move. The key move was organizing the dashboard into one prioritized view that helps analysts move from monitoring to action.

Security teams weren't short on data, they were short on clarity.

Hero image · IMG-01 — The Velocity security dashboard: security health, top alerts, entities at risk and activity timeline in one view.

My role

Product Designer

Research synthesis, wireframes, user flows, visual design, dev handoff and build support.

Tools

Figma
Miro
Notion
Zeplin
Pen & paper

Team

Product Design Lead
Product Manager
2 Full-stack Developers

Goals

The challenges

Security teams face an overwhelming amount of information every day: alerts, incidents, risk indicators and system events, generated constantly and spread across multiple systems. The hard part isn't finding data, it's telling critical issues apart from background noise.

Designing a security dashboard meant balancing large volumes of real-time data with the need for clarity, speed, and action. Through research and exploration, I identified four core challenges to solve.

Visualizing complex security data: present large amounts of security information in a way that's easy to scan, understand, and act upon.
Providing context and prioritization: help users quickly understand severity, impact, and urgency through a clear visual hierarchy.
Supporting fast decision-making: surface meaningful insights and recommended actions that let users respond quickly to threats.
Reducing alert fatigue: highlight critical information while minimizing noise, helping users stay focused on what matters most.

Design exploration

Research and user needs

Through 5 user interviews and close collaboration with security stakeholders, I identified the core needs: immediate situational awareness, clear risk prioritization, actionable information (context and next steps, not just more data), real-time visibility, and reduced cognitive effort. These findings became the foundation for the dashboard structure and information hierarchy.

11K+

Alerts a security team receives per day (Forrester, 2020)

~70%

Of analyst time spent triaging alerts, not hunting threats (Forrester)

67%

Of IT teams ignore lower-priority alerts (State of Network Security, 2020–21)

Design exploration

Wireframes

Following research and a competitive market analysis, I designed three distinct wireframe concepts for the dashboard layout and weighting system. The wireframe phase answered hard questions: what belongs above the fold, how risk indicators should be prioritized, which metrics deserve permanent visibility, and how a user moves from overview to investigation without friction.

Concept 1 · IMG-05 — Wireframe concept 1: exploring layout and content hierarchy for the dashboard.

Concept 2 · IMG-06 — Wireframe concept 2: a different weighting of monitoring vs investigation.

Concept 3 · IMG-07 — Wireframe concept 3: balancing high-level overview with detailed drill-down.

Research

User flow

Before visual design, I mapped the investigation workflow of a security analyst: from opening the dashboard, to reviewing overall health, identifying critical alerts, investigating affected entities, understanding severity and impact, reviewing recommendations, taking action, and monitoring the outcome. Mapping it end to end surfaced the key decision points and shaped the dashboard's architecture.

The security analyst's investigation flow: from dashboard overview to action and monitoring.

Final

The final design

The final dashboard combines real-time monitoring, prioritization, and actionable insights in one view. A Security Health overview puts the overall state of the environment up top; Top Alerts highlights the most critical threats first; Entities at Risk surfaces affected assets, systems and users; an Activity Timeline gives context around events and trends; Recommendation cards turn data into clear next steps; and Protection Progress lets teams track how their security posture improves over time.

Screen 1 · IMG-09 — Security Health overview: key metrics and risk indicators above the fold.

Screen 2 · IMG-10 — Top Alerts and Entities at Risk: critical threats and affected assets, prioritized.

Screen 3 · IMG-11 — Activity Timeline: event context and trends over time.

Screen 4 · IMG-12 — Empty state: no alerts detected.

Screen 5 · IMG-13 — System empty state: no alerts to show.

"The goal was never to show more, it was to make the most important thing impossible to miss."

Outcome

Outcome & reflection

The redesigned dashboard gives security teams a clearer, more actionable view of organizational security. Stronger information hierarchy, better prioritization, and real-time visibility turn complex cybersecurity data into a practical decision-making tool, directly answering the problem the research surfaced: teams weren't short on data, they were short on clarity.

Looking back, the core lesson holds up: in a domain where an analyst faces thousands of alerts a day, the design's job isn't to display everything, it's to make the one thing that matters impossible to miss, and the next action obvious.

Helps teams identify critical threats faster and reduce investigation time.
Keeps analysts focused on high-priority risks while maintaining awareness of overall posture.