ZEROFOX
request-to-delivery system for managed intelligence
Request for Intelligence: discovery · intake · triage · scoping · analyst collaboration · delivery
Year
2022-2023
Tools
Whimsical, Figma, Jira
Deliverables
Workflow architecture
Role-based information architecture
User flows & service states
Wireframes & interactive prototypes
High-fidelity interface design
Product Team
My Team
1 UX systems architect
My Role
Lead product designer
Systems architect
Researcher
Research
2 Contextual inquiry sessions
9 user interviews
Summary
ZeroFox provides managed intelligence on cyberattacks, threat actors, and emerging risks. Clients could request deeper investigation into a specific threat, but the request, payment, scoping, collaboration, and delivery process was handled through email.
I led the design of an on-platform RFI system that connected contextual discovery, structured intake, role-based triage, secure client–analyst collaboration, credit-based payment, and final delivery across the ZeroFox platform.
Problem
The email-based process gave clients and analysts no shared view of request status, scope, ownership, or delivery. Unstructured intake slowed triage, while off-platform credit handling delayed the start of investigations.
Analysts struggled to prioritize and manage incoming requests. Some clients were also prohibited from transmitting sensitive material by email, excluding them from the service and limiting potential revenue.
Research & Process
I conducted three contextual inquiry sessions with one staff analyst and two power users of the legacy RFI process, followed by nine recorded interviews- five with clients and four with ZeroFox staff.
The research revealed three distinct roles within the service: client, staff analyst, and managing analyst. Each required different information, actions, permissions, and visibility into the request lifecycle.
Key Finding: reduce time before investigation Off-platform payment was not necessarily a barrier to purchase, but it substantially increased the time between submitting a request and beginning the investigation.
Key Finding: begin at the point of discovery Clients often recognized the need for deeper intelligence while reviewing existing platform content. Initiating an RFI from that context could preserve relevant information, reduce duplicate entry, and keep the process on-platform.
Key Finding: support role-specific operations Clients needed transparency and secure communication; staff analysts needed structured scope and collaboration; managing analysts needed queue visibility, assignment controls, and workload management.
System Design
The resulting RFI system spans three existing ZeroFox products and introduces three new workflow surfaces. It keeps the service on-platform from discovery through delivery while connecting requests to ZeroFox’s role and credit systems.
- Contextual request entry: Placed RFI entry points within the platform areas where clients were most likely to discover intelligence requiring deeper investigation. Relevant platform context could carry into the request.
- Structured intake: Designed a standardized intake workflow to collect the threat, context, urgency, supporting material, and other information analysts needed to begin triage.
- Role-based triage and queue management: Routed submitted requests into a shared analyst queue with role-based controls for reviewing, assigning, prioritizing, and managing work.
- Secure scoping and collaboration: Created a secure client–analyst conversation where questions, attachments, scope decisions, and delivery updates remained attached to the request.
- Scope and transaction audit trail: Represented formal scope changes, request opening, request closing, and credit events within the conversation, creating a durable operational record.
-
Integrated credit handling: Connected requests to funded client accounts so credits could be calculated and deducted within the workflow instead of through a separate payment process.
Results
Client experience:
- 63% of new RFIs were initiated from linked platform content
- 58% reduction in RFI-related support tickets
Analyst operations:
- 74% reduction in time to scope an RFI
- 48% improvement in on-time RFI delivery
- More than 35% increase in RFI revenue in Q4 2022 following the launch
- Approximately 36 companies previously blocked by email-security policies could now use the service on-platform