Security Data Lake.
A net-new product letting customers query everything their integrations capture. Zero-to-one from research through GA.
- Client
Red Canary- Role
- Lead Product Designer
- Team
- 2 PM · 6 Eng · 1 Designer
- Shipped
- Q3 2024
- Type
- 0→1Innovate
- Result
- GA in 9 months
Friction
- ↗Customer data was not retained in an accessible way for long enough.
- ↗Customers could only see data when it was attached to a security threat, not on their own terms.
My Role
- ↗Led UX strategy and design in close partnership with product and engineering.
- ↗Defined the workflows for monitoring, exporting, and querying data lake content.
Outcome
- ↗Shipped SDL on time with especially strong praise from enterprise customers.
- ↗Reduced compliance-driven churn risk.
- ↗Won positive feedback and new contracts once the search experience launched.
Summary
We built the Security Data Lake (SDL), a new feature enabling customers to query their Red Canary data in real time. It solved compliance pain, elevated customer satisfaction, and gave users far more transparency and control over the data they were already sending into the platform.
The Problem
Customers had very little visibility into the huge volume of data flowing into Red Canary. Outside of detections, they had no simple way to inspect, query, or report on what was already theirs.
That gap created compliance headaches for regulated customers and blocked deeper investigations for security teams that needed more than the default product views.
The Solution
SDL was intentionally phased so the team could solve compliance and reporting pain early, then layer in deeper search capability without blocking the whole initiative.
The first release focused on a dashboard with at-a-glance usage, integration-level breakdowns, historical trends, and export support for compliance work.
For the query tool, I leaned on patterns customers already understood so the product felt powerful without forcing them to learn a bespoke interface.
Searches exposed their expected cost before execution so customers could avoid blowing through query limits by accident.
The Process
Exploration
Low-fidelity wireframes mapped the core layout and key interactions before any visual decisions were locked in.
Identify the real customer need
Support tickets and recurring feedback made it obvious that customers needed direct control over their own data, not just another preset dashboard.
Define the MVP phases
We prioritized a high-impact snapshot dashboard first, then followed with the SQL query tool for deeper investigation and more technical workflows.
Design and test quickly
I worked closely with engineering to validate feasibility and tested prototypes with early adopters so we could refine usability before wider release.
Shipped
The final experience, tested with customers and validated through iteration.