IoPA: Research Changed the Roadmap. AI Changed the Delivery Speed.

Challenge

Approach

—Before designing the map, researched how the industry displays dense, high-volume threat data: attacker-centric exposure radars (IONIX), graph-pivot investigation tools (OpenCTI, Amazon Detective, Google Threat Intelligence), and compliance network diagrams. None solved the specific problem here: 200+ assets in one cluster, some isolated, some deeply connected.

—Researched real high-asset scenarios, not the polished demo, and added My Assets so the analyst could locate themselves in the threat story.

—Refused to stamp clusters with a single severity label the system couldn't back; showed structural facts (counts, seeds, pivots) instead.

—Ring clusters, hover-to-focus, a full-width side panel, and a 200-node table fallback so the view stayed honest at real density.

1

2

• 1911 nodes, real density: Built against real cluster scenarios, not the 6-node demo, so the taxonomy held at the density analysts actually hit.
• 2Pivot node, not a severity label: The system couldn't back a single risk verdict for this node, so it shows a structural role instead, seed, pivot, or connection, never a certainty it doesn't own.

—Added click-to-drill for deeper detail per asset type, and connection lines between elements so the map reads as the threat's path, not a static inventory.

—Designed every runtime state (loading, enriching, error, empty, ready) on its own, so the UI never implied more certainty than the backend could support.

—The ring colors, badges, and side panel aren't a custom palette invented for this screen: they pull from the same token set and component library documented in Imminent Threats, the shared source every Malanta workflow draws from.

Two entry points, one investigation

Where the flow stops today, and where it's going

Impact

▸Triangulated Mixpanel, session recordings, and analyst interviews to ground the redesign. Six months post-launch, Mixpanel confirmed it: 27 of 31 verified customer accounts had used IoPA independently, spanning 11 organizations across cybersecurity, government, healthcare, insurance, and finance. Nearly half of those users returned 11+ times, averaging 80 seconds per session, the third-highest dwell time in the product.

▸30% of page visits (52 of 172) were analysts navigating to IoPA directly, not redirected from an alert, evidence it functions as a standalone investigation tool, not just a click-through from a notification.

▸Built the filtering against real cluster scenarios: 800 assets tied to a single node, clusters scaling into the hundreds of nodes, up to 911 assets rendered on one screen.

▸An AI-built prototype wired to live backend data let me hand engineering an interaction-complete spec, not a static mockup.

▸Defined how I'd validate the redesign before shipping it, not after: adoption (independent-entry rate, return rate), depth (filter, pivot, and export usage paired with dwell time), and outcome (investigations ending in a concrete action, time-to-action), backed by a small customer advisory sample.

Validation

Qualitative first, quantitative confirmed it later

Malanta's SOC analyst base was small, 5-10 active users at any point, not enough for a quantitative test to reach significance. So instead of one-off usability tests, I built an ongoing relationship with the 2 analysts closest to daily use: cyber researchers and analysts inside the company, not external test subjects. Six sessions over about two months, spanning early feature ideation and later usability testing, each one covering something different: sometimes the whole system, sometimes a single feature or flow, sometimes how information connects across screens. The same two voices recur across my case studies because they were the two people who actually lived in the product every day. Six months after launch, Mixpanel data confirmed what those two analysts predicted: independent, repeat usage across a real base of enterprise and government accounts, not just the redirect traffic the roadmap originally optimized for.

What I'd do differently

Retrospective

• —Follow-up interviews with 2 senior analysts confirmed the fix cut visual noise, but time-on-screen barely moved, which surfaced the real finding: analysts don't browse IoPA, they arrive only mid-investigation from a concrete threat to their own assets. That reframed what success on this screen should even measure. If I had more research bandwidth, I'd want a small quantitative check (time-to-triage) to back that signal before this pattern scales to other workflows.
• —The loop back to Imminent Threats to act on a finding is still a manual step today, that's the real bottleneck the vision branch is built to close, not yet shipped.
• —I'd bring the user's own assets back onto the map, ranked by significance instead of arrival order. I prototyped exactly that with AI in an afternoon, to prove the interaction, not just describe it.
• —I recommended progressive disclosure of assets inside a cluster, revealing them on demand instead of rendering all ~200 at once, an idea V2's cluster-bubble view had already tested at the cluster level. The product manager prioritized a client demo deadline instead, so V3 shipped at full density. Progressive disclosure at the asset level is still the plan for the next version.