Cyberint · 2016 · UX Research & Concept Design
Cyberint's threat intelligence platform: one flow for every threat indicator, beyond the perimeter.
2016 as shipped
Designed nine years ago, and it looks it: deliberately left as it shipped. Still in production today under Check Point: see it now →
Still in production a decade on: see Impact
Give customers cyber protection that goes beyond the perimeter: letting analysts find, map and study threats using a growing set of collected indicators.
Analysts across three different organizational contexts (end customers, MSSPs, and Cyberint's own SOC) needed one shared investigation workflow, with no existing shared vocabulary, prioritization logic, or way to trace how indicators connected to one another.
01. Users map & personas
Three contexts, the same investigation, and a different amount of the system each is allowed to configure.
Argos needed to serve the same core workflow across three organizational setups: end customer, Cyberint's own SOC, and MSSP/SOC partners. I mapped five roles across them (Analyst, Operational Manager, Risk Manager, Third Party Operator and CISO) profiling each by frequency of use, task importance, and cost of a mistake.
The gradient below is the part that shaped the build: end customers would get some configuration in a later version, MSSP partners additional, and Cyberint's own SOC all of it. One interface had to hold all three without feeling stripped for the first or cluttered for the last.
The organisation being protected
Some configuration next version
Works through indicators to identify threats to their own organisation.
Manages the analyst team and QAs their performance and output. KPI oriented.
A partner defending someone else's estate
Additional configuration
Works through indicators to identify threats for external customers.
Team management, new customer domain specification, QA, and cross-customer analysis.
In-house super users
Full configuration
Same investigation work for external customers, with every setting available.
Team management, new customer domain specification, QA, and cross-customer analysis.
User interviews · 3 participants
02. Terminology & system goals
A shared vocabulary had to exist before a shared screen could.
Before any UI work began, I defined the system's core terms: Indicator, a potential threat found through open-source keyword search, and Online Asset, the customer properties to protect: websites, IPs, social channels, DNS. Every later design decision was anchored to that common language.
Vocabulary agreed with Cyberint's SOC, product and R&D before any UI work began. Who the users are (end customer, MSSP, in-house SOC) is set out in 01.
03. Functional & UI requirements
Functional pillars, mapped directly from analyst tasks.
I documented seven functional requirement areas, from processing incoming indicators to managing the cyber knowledge base and tracking team KPIs, plus UI requirements covering visualization, fast data entry and multi-customer management.
04. Investigation methodology · 5W
A “what / who” framework for every investigation.
I mapped the investigation flow onto a 5W model: what identifies the attack type and target (region, sector, product, vulnerability), and who identifies the attacker or attackers, and any connections between multiple actors.
This shipped nine years ago, and it looks it. That is worth stating plainly rather than leaving a reader to wonder, because most of what dates the screens was the right call at the time:
What I would change now: the density is defensible, but the visual hierarchy leans on borders where it should lean on space and weight, and the filter panel would be a progressive disclosure rather than a wall of fields. The investigation logic underneath it is the part that held: see Impact.
Investigation flow
From a received indicator to a closed incident, or a deleted one.
Every branch an analyst can take, mapped before any screen was drawn: triage the indicator, investigate it with consultation, the knowledge base and mark-for-later to hand, then either raise an incident and coordinate through to resolution, or stop.
The platform, as designed
One screen holding the grid, the text, and the relationships between entities.
Solutions
Area 01. Grid
The grid shows condensed, scannable information across all indicators, so an analyst can move fast between threats before committing to one. It's the master in a master–detail layout: every other panel updates from what's selected here.
Area 02. Indicator: text & analysis
This area combines a relationship graph, a timeline, and the full text and analysis of the selected indicator. Interaction depth scales with intent: hover to scan without committing, click to surface connections, open to enter that entity's own page. That let analysts explore broadly or drill in, without the UI forcing one mode.
Area 03. Navigation: folders & tabs
Folders let analysts organize indicators into working sets; tabs let them keep multiple investigations open side by side without losing context on any one of them.
Area 04. Filter system
A flexible filter system supports complex boolean queries, with the option to save a query for reuse. The advanced panel pins open and pushes the grid down rather than overlaying it: keeping daily filtering fast while giving power users full control when they need it. It's the same trade-off I'm solving again today in a bulk-actions filter system, this time looking at Linear, Datadog and Retool.
Area 05. Profile card
Each entity (threat actor, asset, indicator) got its own profile card, surfacing additional context and letting analysts manually enrich it with new information as they investigated.
Area 06. Gamification dashboard
A gamified dashboard was designed to encourage analysts to manually enrich data, compensating for technical limitations in automatic enrichment at the time. It was cut from scope before launch: a deliberate trade-off given the platform's technical constraints at that stage.
Impact · 10 years later
A concept that outlived its own deck.
A decade after this project, the platform I helped conceive is the foundation of what Check Point now offers as part of its threat-management suite, following Check Point's 2024 acquisition of Cyberint into its Infinity Platform. It's still being developed today, and its current UI carries forward the same investigation logic mapped here: a Threat Actor Heat-Map echoing the original link-analysis diagram, and a filterable News Bulletin echoing the original grid-and-filter structure.
Watch Cyberint's current platform walkthrough →
Product screenshots, 2025–2026 · Cyberint blog: The 5 Biggest Feature Additions to Cyberint in 2024