Rebuilding a security product through acquisition

Context

IT providers are on the hook for their clients' security

Security services had become one of the fastest-growing revenue categories in managed services. Microsoft provides the frameworks and the data, but it's scattered across every client tenant. A provider managing dozens of them has no single place to see what's wrong, or prove to a client that it's fixed.

One IT service provider securing all Microsoft 365 services and data across many customers.

Problem

How do we scope this project down?

The legacy product was too broad for its new audience. Its features went deep on technical capability, built around a specific kind of power user, and usage metrics showed stagnant adoption across several of them.

Navigator reporting moved forward. Manager's command-and-workflow feature set didn't.

Approach

Scope down, then invest in the platform

We scoped to reporting and left the rest behind. Before any security feature could work, partners had to connect their Microsoft 365 customers, the source of all the data. I designed it to be built once, so any team could turn it on. Consolidating four connectors into one cut setup authorizations by 75%. Another team had it on their roadmap before we finished shipping.

A code-based prototype of company mapping, the first step in connecting a partner's customers.

Solution

The product had to sell itself

ConnectWise's partner base was broader and less technical. I pushed for more than a rebuild, fixing years of UX debt without adding scope. Each capability had to pay off fast and give sales a simple story.

Engagement cards

I brought in a pattern I'd proven at SkyKick, cards that reflect a partner's progress and prompt the next step. ConnectWise relied on the service team for activation; the cards drove it in-product. I defined the components in the design system so other teams could build on this approach.

Engagement cards in their active state, showing live metrics across connections, reporting, configuration, and monitoring.

Automated reporting

For an IT service provider, a multi-customer security report landing in your inbox Monday morning was dreamy. I designed it as a scheduled task, with every run logged and past reports kept for client reviews.

The scheduled task wizard sets up automated reporting and email delivery.

Security posture

Everything starts with a baseline. A partner assigns a custom one or uses a framework standard like Microsoft, CIS, or HIPAA. I designed every control to keep its own history, so a tech can see what drifted, fix it, and show the client the record.

The activity log for a baseline control, where a user tracks drift and remediates it.

Outcomes

Beyond scope

We demoed SaaS Security internally, and before launch leadership moved it above the legacy security products in the platform navigation. The Microsoft integration shipped first, SaaS Security close behind. The integration's tenant data seeded a new Microsoft Defender product, and that team brought me in to guide its UX and technical direction.

“Now our ops team is able to validate and report on all our clients’ security posture in a single pane … allows us to manage more clients with the same resources.”
— Cloud Solutions Architect

MonthsScoped, rebuilt, shipped on time

1st

IntegrationFoundational to the platform

New productMicrosoft Defender seeded from data

With more time

There was no shared vision for the security suite. The product owner and I started building one, and I began mapping the partner journey across the Security org. Multiple products, one path from activation to full adoption. I'd have pushed that further.