Case study · Cybersecurity SaaS · Web
CyberDefenders
CyberDefenders is a blue team training platform for SOC analysts, threat hunters and DFIR professionals. As its product designer, I reimagined the lab experience, the dashboard and the certification flow, and designed how new users find their way in, to make the platform easier to use, more engaging and consistent throughout.
At a glance
- The problem
- New users had to work out on their own where to start, between hands-on labs and structured certification, and the lab, dashboard and certification screens didn't feel like one product.
- What I did
- Redesigned the dashboard, the labs and the lab page, designed onboarding with a starting point and a getting-started checklist, empty states, a pause-instead-of-cancel flow, payment recovery and AI hints, and ran usability testing and design QA with engineering.
- The result
- Live on cyberdefenders.org, with user activation improved through clearer onboarding and feature discovery.
Project timeline
- Labs, dashboard, onboarding, billing and AI hintsSep 2024 – Aug 2025
A dashboard that knows where you are.
The dashboard opens with a getting-started checklist, from enrolling in a track to submitting a first correct answer and joining the Discord server, each with a button that takes you straight there. Around it sit the things that keep people coming back: a daily streak, a title to level up to, world and country ranks, a radar of skills across areas like malware analysis and threat intel, and the labs in the current track with their progress.
A lab page built for the investigation.
A lab is where the learning happens, so its page puts the work first. The machine controls and progress sit on the left with community walkthroughs, the first and last solvers, and help from Discord or the help center. On the right, the scenario, instructions and tools lead into the questions, each with its own hints and submit button.
Choose your starting point.
CyberDefenders offers two different products, hands-on labs and structured certification, and new users had to find their own way between them. Onboarding now begins with that choice. Hands-on practice leads to CyberRange and its SOC tracks, from Tier 1 fundamentals up, and structured training leads to the certification dashboard in preview mode, with its lessons, labs and final exam.
Nothing is ever just empty.
Every empty tab says what to do next: enroll in a track, start solving labs, or browse labs to bookmark. The getting-started checklist is designed for each of its steps, from zero of five to done, and banners cover the moments in between, from a failed payment to preview mode.
Hints that follow your thinking.
When someone is stuck on a question, a generic hint rarely helps. AI hints look at their wrong answers to work out how they’re thinking, and suggest a hint that leads them on from there. Hints are generated on request, marked as smart hints, and kept in the question so they can be read again.
Take a break instead of leaving.
Cancelling starts by showing what you’d lose, such as faster machines and unlimited cloud machine time, and asking why. Some reasons, like being too busy for now, are better served by a pause, so the flow offers one: up to three months off, without being billed, before the subscription picks up again.
A failed payment, without a dead end.
When a card is declined, a banner links straight to updating the payment method while there’s still time. Once the grace period has passed, the labs are locked, and a friendly page explains what happened and lets people update their card, or pay another way, in one place.
Final notes
Most of this work happens around the labs rather than inside them: deciding where someone should start, what an empty screen should say, and what happens when a payment fails or someone wants to leave. Those moments decide whether people come back, so each one got a design of its own, with a clear next step, instead of being left as an edge case.