- Role
- Led design end to end – discovery, research, UX and UI. PRD and roadmap owned by PM.
- Team
- Designer (me), PM, engineering pod of 6 – front/back-end
- Timeframe
- Spring 2023
- Context
- Hoxhunt is an enterprise cyber security awareness training platform that uses a gamified training approach to increase employee engagement and improve learning outcomes.
Hoxhunt Security Awareness Training
Closing a competitive gap by redesigning Hoxhunt's security awareness training from one-at-a-time question drip into full courses.
Training – one question at a time
One (painful) part of being an employee in a larger company is going through SATs – Security Awareness Trainings. On most platforms this usually takes place in the form of a dull Powerpoint presentation or an online quiz. Hoxhunt had SAT quizzes too, but they arrived one question at a time, triggered only when a user reported a simulated phishing email. Running a comprehensive training wasn't possible. Furthermore, low employee engagement and user tendency to ignore SATs were a persistent pain point for security officers (CISOs) who are responsible for conducting them.
How Might We
Redesign the one-question-at-a-time SAT feature in a way that would work for conducting comprehensive multi-question SATs in one sitting?
Success criteria
Because this was a table-stakes feature meant to close a known competitive gap, we didn't define specific upfront metrics. Success would show up indirectly — in sales conversations where the absence of this feature had cost us deals, and in retention as customers consolidated training onto our platform.
Facing our assumptions
Two assumptions needed validating before we could scope V1. I tested them through CISO interviews and a risk prioritisation matrix run with the whole team.
1. A scoping question for Version 1 of this feature: do CISOs need to have the ability to create their own training quizzes or can they live with a set of templates we provide? Through customer interviews we were able to find out that CISOs were OK with picking from a pre-defined set of quiz modules. The custom module editor was high on the priority list, but it was a complex feature that we could launch without.
2. We knew that end-users need to be nudged and reminded about assigned security trainings. A reminder system could be built in multiple levels of complexity and customisability. We needed to find the right level of complexity that would satisfy the CISOs and would not be too complicated to build. Reminders were a given, but the open question was how configurable they needed to be. Our interviews told us that the most important thing was that the reminders are sent at all, the content and cadence didn't need to be customisable. So V1 shipped a simple email reminder on a fixed schedule with fixed content.
The hard call
During the initial design phases, I proposed a design that reused as much as possible of the existing SAT feature elements. This approach was optimal for launching the feature as quickly as possible and leaving room for iterative optimisation based on user feedback. This approach was rational from a product perspective and aligned with a lean / agile approach.
However, in the design review, our head of design argued that although reusing large swaths of the existing designs was easier to build, this approach didn't move the product experience forward. Our product differentiates itself on engaging user experience that uses visuals and gamification to make cyber security training enjoyable. The argument that convinced me to push for a more elaborate design was that this had to be built-in to the feature from the start. Whatever we built as Version 1, that would be our baseline for all future improvements.
Pushing the design in this visionary direction cost us a few more weeks in development and I had to convince the engineering team and the product manager that it was worth it. We were able to scope the design in a way that it didn't affect the delivery timeline too much because the changes were mostly in front-end and we could test the feature while things like illustrations were still in progress.
Moving it over the finish line
The second iteration of the design used smooth animated cards that flew away after the user answered the questions. I also worked with an illustrator to create illustrations for each question. The final screen summarised their score, with the illustration changing depending on how they did.
On the administrator side – admin users could decide the passing score and whether the training was mandatory. After publishing, the package becomes available to all employees (no group segmentation) and employees could access the training through our dashboard or a direct link in the email.
Outcomes
We saw gradual and steady adoption throughout the first months. The retention signal after the release was positive – customers started consolidating their training onto Hoxhunt rather than splitting it across platforms.
We also received positive feedback from the sales team – lack of SATs was a persistent pain point for converting new sales and now that hole was plugged.
What I learned from this
Building this feature taught me a lot about scoping – from scoping the CISO feature set down into a manageable build to scoping the end-user experience up into something that elevated the previous experience and created a solid foundation for future iterations. With a B2B product and delivery focused team, these sorts of decisions can be difficult to push for, and, I now realise, this is one of the most important parts of a product designer's job description.