Nightfall AI
End-to-End
Security Journey
I connected onboarding, policy creation and alert resolution into one guided security workflow, while preserving compatibility with existing integrations.
Overview
- The problem
- Complex policy setup delayed the first useful alert. Notifications in Slack and email left no shared place to investigate violations.
- My responsibility
- Founding Product Designer, leading the 2022–2023 redesign across onboarding, policy creation and alert resolution with product and engineering.
- The key decision
- Guide new customers through setup while retaining the underlying policy schemas for existing integrations.
- What changed
- A guided setup and an in-product violations dashboard connected configuration to investigation and remediation.
1 Business Challenge
As Nightfall scaled its footprint across more SaaS integrations, we observed two recurring barriers in customer onboarding:
Onboarding friction
Even after customers provision their integration (e.g. Slack, Google Drive, GitHub), the first policy creation experience was too complex, lengthy, and intimidating. Many users would stall before configuring even basic rules.
Disconnect between policy and action
Originally, Nightfall only surfaced violations through Slack and email notifications. Once an alert was dismissed, it disappeared — leaving customers without a single source of truth or history for investigation.
Because policy creation is core (every integration needs it), any onboarding friction cascades into lower adoption, higher support load, and slower ROI for customers.
Goals
As Founding Product Designer, I owned the redesign across onboarding, policy setup and alert management. I partnered with product, engineering and GTM to connect setup decisions to customer adoption and a faster path to the first useful alert.
My goal was to help customers:
- Get to their first real alert within 30 minutes
- Configure policies with confidence (fewer errors, fewer support tickets)
- Transition from distributed alerts to a centralized Violation Page for long-term remediation and reporting
- Maintain legacy policy compatibility for existing enterprise users
2 Process
Interviews and shadowing highlighted two points of uncertainty: which settings to configure first, and whether a policy was safe to publish. I used those findings to sequence setup, add validation and introduce a final review. The notes below summarise the themes from that work.
Waiting too long for the first useful alert
Unclear which settings to configure first
Uncertainty before publishing a policy
Guide setup without breaking existing policies
I reworked the onboarding experience into a guided wizard:
- Redesigned onboarding into a guided setup with better instructions
- Sequenced steps, inline validation and a final review, while keeping existing policy schemas
The guided flow made the next step explicit. Keeping the underlying policy schemas preserved compatibility with existing integrations.
Violation alerts approach
Meanwhile, I also created a Violation Dashboard to store all the violation alerts that includes:
Contextual details
(source, user, timestamp, detection type)
Inline remediation actions
(Resolve, Redact, Mark as False Positive, Add Note)
Search & filtering
by severity, source, or integration
Audit trail
for compliance and reporting
This created a single source of truth for all security incidents across Slack, Drive, and GitHub — bridging the gap between detection and resolution.
3 Results
The redesign connected three previously separate tasks: linking an integration, configuring a policy and acting on a violation.
Onboarding
Introduced a lightweight, scalable modal that lets users link any SaaS integration with minimal steps.
This pattern later evolved into a foundational framework used across Nightfall’s setup and configuration experiences, like Slack or Google Drive.
BeforeAfter
Policy creation
I redesigned the builder into a guided, multi-step experience—moving away from a dense one-page form.
Each step now features breadcrumbs, progress indicators, inline validation, and dependency warnings, with a final review screen ensuring accuracy before publishing.
before- breadcrumbs, progress indicators
- guided, multi-step experience
- inline validation
- dependency warnings
Violations page
Expanded alerts beyond Slack and email by introducing an in-product Violations Dashboard, giving customers one place to investigate and act. Each alert card includes a short summary and snippet preview, with all activity syncing seamlessly back to the main system.
- Search & filtering
- Inline remediation actions
- Contextual details
- Audit trail
| Reported measure | Before | After | Change |
|---|---|---|---|
| Time from install → first alert | Over 30 minutes | Less than 30 minutes | Below the 30-minute threshold |
| Policy Setup Time | 15+ minutes | 7 minutes | At least 8 minutes less |
| Onboarding completion rate | 50% | 75% | +25 percentage points |
| New integrations supported / quarter | 1-2 | 2-3 | Reported quarterly range increased |
Source: the original project recap. These are reported before-and-after observations; the comparison dates and sample sizes are not specified. They indicate direction, rather than a controlled estimate of design impact.
Takeaways
What went well
- Connected onboarding to the first useful alert with a guided setup
- Added validation and a review step before policies were published
- Gave customers a shared history of violations and remediation actions
- Laid the foundation for scalable alert management across all SaaS integrations
Trade-offs & constraints
- Speed vs. scope: We shipped MVP focusing on resolution and filtering first; analytics and trend reporting followed later.
- Design debt vs. migration safety: Modernized visuals but preserved underlying logic schemas to avoid breaking existing integrations.
- Performance trade-off: Real-time updates introduced slight latency, balanced against the need for reliable record keeping.
The useful shift was connecting configuration to action: customers could set up a policy, understand what it found and resolve the issue in one journey.
Nam Dang
Senior Product Designer