Cisco Secure

Email Threat Defense

RoleSr. Product Designer, design lead When2020–2023 FocusProduct strategy, data viz, design system

A cloud-native Microsoft 365 email-security product. I joined after GA to set design strategy: make threats visible, make investigation faster, and bring the product onto a shared Cisco Secure language.

The problem

The first version told operators they had mail. It did not tell them whether it was a good day or a bad day. Search sat in the center of the home page. Threats were easy to miss. Common actions were a click away from the work they actually needed to do.

Earlier Cloud Mailbox Defense home page with sparse metrics — Before. Search-first home. Little sense of threat. Click to enlarge.

Redesigned Email Threat Defense home with threat summary — After. Threats first, then the rest of the day. Click to enlarge.

What I did

I partnered with customers, support, PM, and engineering. Beta users told us they needed faster judgment: what happened, how bad it was, and what to do next.

Redesigned the landing experience around threat categories, unwanted mail, and shortcuts into quarantine and rules.
Designed investigation: message search, filters, and a timeline that keeps operators inside the work instead of hopping tools.
Built data visualizations so hidden patterns—targets, traffic, risk—could be seen instead of inferred from tables.

Messages investigation view with threat counts and search results — Investigation. Expand a row, open the report, then check remediation. Click to enlarge and step through.

Policy settings with permission mode, message analysis, and allow and block lists — Policy. Permission, analysis, and allow/block lists in one place. Click to enlarge.

Impact Report dashboard showing threat types, targets, and protection totals — Impact Report. Make the last 30 days legible: what hit, who was targeted, what was stopped. Click to enlarge.

Threat risk breakdown by type and exposure — Risk, not just volume. Operators can see which threat types actually matter.

Outcome

The product moved from a search box with two charts to an operator cockpit: home for judgment, messages for action, insights for the story over time.

Selected screens. Some product details omitted.

Previous Nexus Hyperfabric →