Overview
Role
Principal UX & Product Designer
Scope
Preparedness Architecture, Live Session Mechanics, Readiness Scoring Engine, Cross-Platform Systems
Platform
Web, Native Mobile & iPadOS
CYGNVS is an enterprise crisis command center that lives entirely outside corporate infrastructure, allowing executives, legal teams, and security leads to coordinate incident response and tabletop exercises when primary networks are compromised.
Most organizations discover the fatal gaps in their cybersecurity plans during a real crisis, when every hesitation costs reputation, money, and evidence. Traditional tabletop exercises are difficult to build, static to run, and tedious to document. As Principal Designer, I helped architect CYGNVS Preparedness, a comprehensive suite spanning Tabletop Exercises (TTX), Asynchronous Drills, the Resilience Score, and Integrated Conference Calling.
The Opportunity
The Problem: The Cost of Hesitation & Unrehearsed Plans
Industry data shows that organizations running regular tabletop exercises reduce breach containment times by over 30%. Yet, enterprise crisis preparation remains fundamentally broken across three operational layers:
Rehearsal as a Rare Event
Building and coordinating a full-team exercise takes weeks of manual work, forcing companies to treat practice as an annual "checkbox" rather than a routine operational habit.
The "Shared Screen" Anti-Pattern
Traditional tabletops rely on static slide decks where participants see upcoming events in advance, destroying the "fog of war" that defines real incident triage.
Unverified Individual Execution
CISOs and executive boards have no way to verify whether individual responders across legal, communications, finance, and IT actually know how to execute their specific playbook actions.
The Strategic Goal
Transform crisis rehearsal from a burdensome annual exercise into a continuous, automated operational rhythm. ensuring every responder is practiced, every playbook is validated, and organizational readiness is quantifiably proven before a crisis strikes.
Designing the Experience
Instead of creating disconnected tools, we designed a unified preparedness architecture where individual practice feeds team rehearsals, and live exercise activity automatically computes enterprise readiness.
Dual-Role Live Tabletop Player (Facilitator Cockpit vs. Participant View)
To replicate the unpredictable pressure of a live breach, CYGNVS re-architected the Tabletop Exercise (TTX) runtime around two distinct visual perspectives:
Integrated Video & In-Line Media
Embedded video tiles, audio controls, and rich media (such as mock ransom notes, dark-web leak screenshots, or system logs) render directly alongside live workstream chat and activity logs.
Participant View & Progressive Reveal
Restricts participant visibility strictly to active and past injects. Future scenario developments remain hidden until the facilitator releases them, preserving the "fog of war" and forcing authentic real-time decision-making.
Facilitator Cockpit
Gives session leaders an interactive timeline to manage queued scenario events ("injects"), launch live decision polls, capture private observation notes, and manage participant hand-raises in real time.
Playbook-Driven Asynchronous Drills
To test individual execution without requiring hours of synchronized meeting time, CYGNVS introduced Playbook Drills
Step-to-Action Mapping
Account owners select a playbook (e.g., Ransomware Response), choose a workstream, and extract required platform actions (e.g., completing incident facts, re-assigning tasks, cycling credentials).
Granular Participant Selection
Built flexible selection logic allowing admins to target entire departments or deselect specific individuals without creating artificial sub-teams purely for testing.
AI Scenario & Situation Generation
An embedded AI engine parses complex playbook steps and drafts realistic, role-tailored scenario prompts and individual action directives in under five minutes.
The Resilience Hub & Scoring Engine
To give CISOs and executive boards clear visibility into operational readiness, we designed the Resilience Hub around a standardized credit-score mode
NIST & Platform Decomposition
Translates raw platform activity (drills completed, playbook freshness, team onboarding) into a transparent 300–850 score mapped across the 5 NIST framework functions (Identify, Protect, Detect, Respond, Recover).
Impact-Ranked Recommendations
Surfaced an actionable, prioritized list showing the exact point gains added by completing specific actions (e.g., "+19 pts: Step up from annual to quarterly drills").
1-Click Board Scorecards
Designed an automated export engine that converts real-time platform metrics into clean, 1-page PDF/PPTX summaries for executive presentation
Automated Evidence & After-Action Reporting (AAR)
The documentation that previously took weeks following an exercise is converted into an instant platform output
AI-Generated AARs
Synthesizes facilitator observation notes, poll results, workstream activity logs, and timing metrics into structured findings and corrective action plans.
Signed Completion Certificates
Generates non-editable, CYGNVS-branded PDF certificates containing date-stamps, participant rosters, and verified completion records for regulatory and insurance compliance.
Outcome & Business Impact
> 30% Faster
Accelerated Breach Containment
Replaced static slide decks with progressive-reveal tabletop injects, driving measurably faster decision alignment during active rehearsals.
< 5 Mins
Automated After-Action Reports
Reduced post-exercise reporting time from weeks of manual consolidation to under 5 minutes using automated AI synthesis
100% Audit-Ready
Defensible Compliance
Delivered signed completion certificates and immutable activity logs accepted by major cyber insurers, boards, and regulatory bodies
other projects