Case study · AI cybersecurity
DFend
Designing DFend: an AI-driven cybersecurity assistant that protects users proactively—before threats become problems.
Personal note
I worked as principal product designer on DFend while the team was still defining what “proactive” security should feel like on a phone. The short version: we weren’t polishing an existing antivirus flow—we were inventing a product that could act on someone’s behalf without turning into noise or surveillance theater.
That meant a fresh UX foundation: trust in autonomy, clarity when stakes were high, and language that didn’t assume everyone spoke security. Everything below is how I helped the team stitch that story into shippable product.
01
Understanding the landscape
What made DFend different
Before we chased visual polish, we named what made this build unlike a feature sprint on an existing platform—because those constraints change every design decision.
What kept surfacing in working sessions — No baseline product to inherit. AI had to earn trust, not demand it. Account recovery and identity flows had to be unambiguous. Conversational UI had to carry real logic. And the experience had to work for both security-native users and everyone else.
- No existing baseline — A brand-new product meant designing an entire end-to-end flow from scratch.
- AI trust & autonomy — Users needed clarity and comfort around letting AI take meaningful actions on their behalf.
- Security-critical decisions — Account recovery, suspicious activity, and identity protections required zero ambiguity.
- Conversational interactions — A chatbot-like interface needed to handle complex logic while remaining approachable.
- Wide user spectrum — DFend had to support both highly technical users and those less familiar with cybersecurity.
02
Why traditional tools weren’t working
Defining the core problem
In interviews and competitive reviews, people weren’t asking for “more dashboards.” They were drowning in warnings they couldn’t interpret—and quietly assuming the product wasn’t doing much unless it screamed at them.
- Too many alerts — Traditional apps over-notify, leaving users unsure what’s actually important.
- Unclear risk interpretation — People didn’t know how serious issues were—or what steps to take next.
- Cognitive overload — Security flows often require too much technical literacy.
- Low confidence in automation — Users weren’t sure when to trust AI to “just handle it.”
Those tensions converged on one product bet: a trust slider so people could choose how much autonomy DFend should take—from “notify me first” to “handle it automatically.”
03
Designing a clearer, smarter experience
What I focused on
My goal was to make cybersecurity feel invisible, intelligent, and intuitive—powered by AI, grounded in user trust.
- Reducing complexity — Converted dense, security-heavy flows into clear conversational steps.
- Designing for autonomy — Built a threshold slider that lets users choose the level of AI control.
- Modernizing visual language — Created a mobile-first, security-forward UI that feels calm, confident, and familiar.
- Balancing transparency & silence — Notifications appear only when necessary; everything else happens in the background.
- Building trust through patterns — Surface explanations, action previews, and clear opt-in moments when DFend acts autonomously.
The high-fidelity prototype supported user testing, flow validation, and production handoff.
04
Results & impact
Proactive, AI-driven personal cybersecurity
The final experience reimagined digital safety as something users don’t have to manage manually.
- Proactive protection — DFend neutralizes threats before they disrupt users.
- User-controlled autonomy — The slider empowered users to decide how much control to delegate.
- Reduced anxiety & friction — Complex flows (password resets, suspicious logins, MFA) became clear, conversational actions.
- Broader adoption — Designed for all literacy levels, expanding accessibility of cybersecurity tools.
- Future scalability — Modular architecture supports subscription tiers, advanced monitoring, and premium add-ons.
Early prototypes showed users completed more tasks, felt more secure, and engaged more consistently than with traditional security tools.