Continuous Vulnerability Management (CVM)

Overview

Continuous Vulnerability Management (CVM) is a cybersecurity platform designed to help SOC analysts identify, prioritize, and remediate vulnerabilities across assets in near real-time.

When I worked on CVM, the experience was constrained by fragmented data, third-party limitations, and inconsistent workflows across vulnerabilities, assets, and patching systems. Analysts struggled to quickly understand risk, act on insights, and scale their workflows.

I was tasked with redesigning CVM into a cohesive, data-driven application that unified workflows, improved clarity, and supported scalable decision-making across the platform.

Problem

Fragmented Experience

• Disconnected workflows across Vulnerabilities, Assets, Patches, and Reports

• Lack of consistency in navigation, filtering, and interaction patterns

Data Limitations & Complexity

• Third-party integrations (Qualys) limited available data and created gaps

• API rate limits introduced latency and scalability issues

• Users lacked visibility into real-time or near-real-time security posture

Poor Signal-to-Noise Ratio

• Analysts struggled to prioritize critical vulnerabilities

• Overwhelming tables without meaningful hierarchy or context

Inefficient Workflows

• Difficult to move from insight → investigation → action

• Filtering and sorting lacked flexibility and clarity

UX Research

To validate usability and identify workflow gaps, I conducted a targeted UX survey with SOC analysts using the CVM platform. The goal was to better understand how users prioritize vulnerabilities, interact with data, and where friction exists in real-world workflows.

Key Findings

• Strong usability foundation
  All users rated the platform as easy to use, confirming that the core experience was intuitive and accessible.

• Data trust was the biggest issue
  Users reported that delayed updates and inaccurate reporting limited their ability to respond to threats effectively.

• Critical vulnerabilities drive behavior
  Critical and active vulnerabilities were the most relied-on KPIs for decision-making.

• Installed patches lacked value
  This KPI was consistently seen as the least useful, signaling a gap in actionable insight.

• Need for centralized, actionable views
  Users wanted a single place to track:

  • Actionable vulnerabilities

  • Non-patchable items

  • End-of-life systems

  • Newly discovered and resolved issues

• Visualization supports faster decision-making
  Trend-based graphs (active severities, historical vulnerabilities) were the most effective in helping users assess risk.

• Feature discoverability gaps
  A portion of users were unaware of filtering capabilities, indicating usability gaps in advanced workflows.

Approach

The redesign was directly informed by UX research insights, ensuring solutions addressed real user needs around data trust, prioritization, and workflow efficiency.

I led the redesign of CVM by focusing on unifying workflows, clarifying complex data, and improving usability at scale.

1. Unified Information Architecture

• Structured CVM into 5 core areas:

  • Insights

  • Vulnerabilities

  • Patches

  • Assets

  • Reports

• Created consistent navigation and mental models across all views

2. KPI-Driven Decision Layer

• Introduced top-level KPI cards across all tabs:

  • Total vulnerabilities

  • Active vs. fixed

  • Patch status

  • Asset coverage

• Enabled at-a-glance risk assessment

3. Data Visualization for Pattern Recognition

• Designed trend charts for:

  • Vulnerabilities (Active vs. Fixed)

  • Patches (Installed vs. Missing)

  • Assets (Coverage over time)

• Helped analysts quickly identify risk trends and remediation progress