Optimize Cybersecurity Administration: Streamlining Workload through Automation
Right-Hand Cybersecurity’s platform uses automation to deliver value for customers by removing repetitive tasks, providing modularity, and managing human risk while taking care of the customer’s context.
The journey to automation
In the beginning, it starts with the ability to create a training program for new employees. CS and customers alike have been requesting this ever since. In time, other use cases emerged, such as automated reporting and scheduling.
The plan going forward is that we would like to create automation templates for as many cases as possible and rather than expanding more pages and screens, we will try to bring as many customer requests as possible through automation.
Why do we think automation aligns with Right-Hand’s company and product goals?
The company aims to increase its Average Contract Value to over $20K per customer per year. There are two ways to accomplish this goal:
- market to larger audiences
- upsell existing customers on more features
Automation features are therefore a top priority since they will have a significant impact on the outcome.
What problem are we solving through automation?
From customers’ perspective:
In terms of customer satisfaction, automation streamlines the process of creating training campaigns, generating reports, and scheduling employee training. Thus, automation saves customers’ time, enables them to achieve more goals, and provides modularity and customization, which are essential for enterprise success.
From the Customer Success team:
Instead of spending their time completing tasks for customers, the Customer Success team will be able to focus on improving the customer experience.
From the Right-Hand’s Company:
Providing automation to our customers will free up their time to focus on more strategic and large customers, which will subsequently have a positive impact on our Return on Investment (ROI).
We listen to the feedback of our customers about the automation
We highlighted the key insights we learned from the feedback session between our Customer Success team and our customers.
- Generally, customers do not think of many ways in which things can be automated by themselves. However, when prompted to do so, they do consider possible scenarios.
- Training and reporting are the two main factors that influence customers’ perceptions of automation.
- The usability may affect how technical and non-technical customers behave when interacting with automation, as some customers have experience automating tasks while others have not.
Which use cases are we aware of?
- Assigning training to newly hired employees.
- Send phishing emails to employees when they are onboarded.
- Automating a report download upon campaign completion.
- Automating Phisharm and Email Quarantine Automation (EQA) workflows.
- Scheduling training yearly, monthly, or quarterly.
- Scheduling custom reports monthly.
Defining the Minimum Viable Product (MVP)
Support for 3 Automation use cases with templates:
- Assigning training to employees when they are on-boarded.
- Automating a report download upon campaign completion.
- Automating Phisharm and EQA workflows.
Requirements
Concepts and internal terminology around automation.
Action
An action is a specific event that takes place in a particular automation step, i.e. send training which is Business Email Compromise after a delay of 3 days. This action will happen when triggered via condition.
Condition
A condition is a specific event that will trigger the actions, i.e. when an employee is onboarded and the employee department is Accounts.
Inclusions and Exclusions
The inclusion and exclusion interface provides control capability for automation, e.g. user group, office location, department, manager, and user.
Schedule
This is a certain event such as custom report generation that does not have a specific event but is related to organizational processes such as monthly executive reporting for metrics etc, for such cases schedules are provided.
Actions blocks or options for actions
Collection of action selections, e.g. training, phishing, reminder, add delay.
Condition blocks or options for conditions
Collection of condition selections, e.g. employee is onboarded, employee risk score changes, employee information is changed.
Brainstorming Session
During the product meeting with my Product Manager, we conducted secondary research through Jira Automation. The Jira platform has a wide range of automation features we can use as an inspiration tool and a way to define our minimum viable product. We provided actions and conditions that could be used by cybersecurity administrators to create automation rules. Thus, creating automation rules was the goal that we wanted the admins to accomplish.
Minimum Viable Product (High-Fidelity Design)
On the first design, Dynamic Campaigns was used as a title since the automation features are campaign-based, e.g. assign training. In the ‘Add component’, admins can choose whether to add an operator, condition, or action.
There are three categories of variables in the condition event such as employee, training, and date. A drop-down list will appear if the employee is selected, such as onboarded, added to a user group, added as manager, etc. In the case of training, an overdue variable will be displayed. Administrators can select the preferred date from the date picker and choose whether it will be recurring.
In the action event, there are four categories of variables, such as training, phishing, reminder, and add delay. Choosing a training will display a list of available courses, such as Business Email Compromise.
The first design iteration along with the prototype
On the left side of the screen, we will have an Automation menu, which the Product Manager and I discussed at the product meeting. In addition, we added context when administrators select a condition and action, i.e. When employee is onboarded. The context will appear under the drop-down. The outcome of their selection will be made clear to them.
Note: Inconsistency existed right before I joined Right-Hand Cybersecurity, as you can see in the button style for both ‘Create Rule’ and ‘Save Rule’. I had discussed revamping the old system with the engineering team, however, we need to launch this feature first to increase the Average Contract Value. Therefore, at that time I was planning to create a new design system and store it in the repository called Supernova. Supernova design system management platform manages the entire lifecycle of a design system in one place. Engineers would use Storybook to develop new UI components. Finally, I decided to apply and unify the new UI components to prevent design debt and technical debt.
Our engineers are still working on the new design system, and we are gradually implementing the new user interface 🙌
Usability Test
We recruited five participants who are our customers to participate in the usability test as part of the validation of our minimum viable product. In collaboration with my Product Managers, I prepared questions related to automation. Usability tests were conducted using Maze.
Usability test questions
- Have you used our campaigns feature before? (Yes/No)
- If yes, how often do you use our campaigns creation per week? (Multiple choice)
- Imagine you were trying to create a rule for a newly onboarded employee. Please could you show me what you would do to get there? (Prototype test)
- On a scale of 1 to 10, how was your experience with the interface (1 = not user-friendly at all, 10 = super user-friendly)?
- What is the automation that you would like to do if this feature was available?
- What is your opinion on the way features and information are laid out?
- How did you find navigating to add conditions, operators, and actions?
- How was the process of creating a rule (super unintuitive, unintuitive, intuitive, super intuitive)?
- Can you imagine and list five automation that you would like to do?
Heatmaps result
The following are the heatmaps that resulted from the usability test.
We conducted the usability test via Zoom in a moderated format, so that both qualitative and quantitative data could be collected.
Heatmaps revealed interesting findings, such as most users misclicked the button to create rules. In general, they succeeded in moving to the next screen, but they sometimes misclicked the components they were supposed to click on. In my assumption, users needed some guidance on how to use this feature, such as contextual tooltips or an interactive walkthrough.
According to our qualitative data, our participants found the rule-making process intuitive. Furthermore, they found adding conditions, operators, and actions to be easy to navigate. However, one participant stated that understanding what each button does was a bit challenging.
The follow-up interviews revealed that only two participants had experience with a similar automation platform and the others had no prior experience.
The second design iteration
Our Product Manager scheduled a product meeting with the CTO and me. Our discussion focused on what we learned from the usability test. Upon reviewing the design, the CTO found that the design lacked context on how to guide our users in using this complex feature in a more intuitive manner that allows them to accomplish the task more efficiently.
During the brainstorming process, I proposed another approach that was more efficient and contextual. Story-telling was the concept behind our automation.
The prototype
In our next product meeting, my Product Manager and I discussed the corner case of using story-telling techniques. By taking this approach, we can communicate the idea of automation clearly and intuitively, but our problem arose when we had to write forming sentences along with options for each action and condition. In particular, if there are associated attributes with the option.
We then brainstormed again and decided to make each action option and condition a block that can be dragged and dropped so that accompanying attributes will appear after an option is selected.
The third design iteration
Finally, we reached the third design iteration where the conditions and actions were modified.
On the right panel, all actions and conditions are displayed as blocks, allowing them to be easily dragged and dropped. Once a block has been selected, its attributes appear.
The prototype
I finalize this MVP design version and we received positive feedback from our customers that the automation simplifies the process for them to assign training, schedule reports, and more.
Our product is constantly being improved, so if you are interested in reviews of our product, then you can check them out on our G2 page.
Takeaways
I found the automation feature challenging. To better understand how automation works, I researched well-known products such as Jira. However, as a result of the usability testing, I discovered that not all participants were familiar enough with Jira automation approach, so I came up with the idea of applying a story-telling approach.
According to Interaction Design Foundation, storytelling in design is pivotal as it bridges the gaps between users and products. Storytelling evokes emotions, guiding experiences beyond mere functionality. Stories evoke empathy, connections, and understanding. They help convey brand identity and make memorable impressions.
Storytelling in UX provides context, painting a rich picture of a scenario from a user’s perspective. Not only does it capture attention, but it also enhances engagement and retention. Designers create intuitive experiences that stick in users’ minds by composing tales. Therefore, storytelling in design isn’t just superficial — it’s about crafting compelling, user-centric journeys that leave lasting impacts.
The release of this feature is hugely exciting for me since the designs bring huge impact to our customers, solving many problems for them and achieving goals we set for ourselves as well.
Among our customers are ABS-CBN, Western Alliance Bank, Chanel, SolCyber, National University of Singapore, Webjet Australia, Sleek, etc.
Thank you for reading! 😊
