The approach
Understand the security leader and their process.
The team had a basic understanding of the space but wanted to deepen it and create provisional personas to rally around. I interviewed about 20 security leaders and their team members about vendor risk assessment, mapped the findings into an end-to-end journey of steps, roles, tools, and pain points, then refined it through a second round of interviews. This gave the team a shared, evidence-based foundation for the concept.
Validate the cybersecurity risk assessment user journey.
The research confirmed known pain points: arduous manual research, unresponsive vendors, and too many vendors to assess. It also showed how these varied by maturity. Less mature IT organizations skipped lower-criticality vendors to focus on high-impact ones that were hard to gather intelligence on. More mature organizations wanted to augment robust processes with insights from peers.
Concept test the design.
I ran 30-minute one-on-one sessions with about two dozen security leaders and their team members to test the concept and its usability at multiple points as they onboarded and acclimated to the tool. I synthesized the findings through affinity mapping sharing early insights with team members along the way to fuel ideation and incremental improvement.
Usability test the alpha version of the tool.
Users found the interface intuitive, but testing surfaced clear friction. Filters returned empty results when matches sat in another category, a key action was buried at the bottom of search results, a critical dialog was too text-heavy, and summary data lacked the context and visual cues users needed.
Outcome
The research took the product from an idea to a validated direction. Discovery grounded the concept in real workflows, and testing gave leadership proof that the concept resonated, a clear picture of the target segments, and a prioritized plan for fixing usability issues. The product was greenlit for beta, with the findings shaping its design and roadmap.