Agentic AI for cyber risk management

Our starting point was an asset risk score: a rating of the risk associated with an individual application, database or system. The first version we developed followed a bottom-up approach, building a picture of cyber risk from those assets and their related threats and vulnerabilities.

This was the approach we first put in front of users.

User testing showed that our first version was not meeting users’ needs. We needed to revisit the assessment journey and understand the broader job they were trying to do.

That prompted a deeper phase of discovery.

We mapped user journeys and worked through how people approached cyber risk assessment. Client conversations, subject-matter experts and competitor analysis helped us build a fuller picture of the work.

Perspectives varied across regions and disciplines. Teams coming from compliance and enterprise risk brought different language and expectations. Mapping their journeys helped us understand where those perspectives connected.

A different starting point emerged: users needed to assess business risk scenarios through impact and likelihood. Technical information about assets, threats and vulnerabilities could inform that judgement, while the assessment needed room for their knowledge of the business.

The next version added a top-down approach to our original bottom-up model. Users could assess a scenario’s impact and likelihood directly, with the calculated score available alongside their qualitative assessment.

This became the hybrid approach. The qualitative assessment leads the experience, while the bottom-up calculation stays visible as supporting context.

The new scoring screen brings the two perspectives into each scenario card. The qualitative row lets the user assess likelihood and impact. Directly below it, the calculated row keeps the technical inputs and their resulting rating visible.

An editable final score sits beside both views. This makes the relationship between the assessments explicit, including cases where they produce different ratings.

I partnered with the PM and supported the product designer, overseeing design and UX pattern consistency across products.

I led design critique sessions for the team, where we reviewed designs and discussed interaction patterns. These sessions were where we worked through how to apply those patterns consistently across products.

I also facilitated several product discovery workshops with subject-matter experts, where we validated user journeys.

The early prototype explored how agentic AI could help with scope, scenario generation, scoring suggestions and rationales. Those interactions remain useful parts of the exploration.

In the revised direction, the risk professional’s assessment leads the scoring experience. Agentic AI supports the work of assembling and reviewing information around that decision.

Users responded very positively to the revised approach. Adding the top-down assessment alongside the original bottom-up view gave us a direction they were happy with and a foundation to keep developing.

The first round of testing had exposed the gaps in our initial version. Deeper discovery and user journey mapping helped us work towards an assessment experience that users welcomed.