Comply

What it is, and who it's for

Companies have to follow security rules — some for their own protection, some required by regulations specific to their industry, like healthcare or payment data. Comply is the part of Tanium that checks every computer in a company against those rules and reports where it falls short, alongside checking for known software vulnerabilities that could be exploited by an attacker. It's used by security and compliance teams responsible for proving their organization meets these standards and for closing any gaps before they become a real problem.

A team can check results two ways: against compliance rules or against known software vulnerabilities. Compliance results show which computers pass or fail each rule. Software vulnerability results show which computers are vulnerable checked against a continuously updated list.

Ordering the product around what people actually needed

Comply was originally organized around configuring the tool and running scans, not around understanding what came back. Working with my product manager and the product team, we instead structured the product around the tasks teams actually needed to accomplish their goals:

• Overview — The running snapshot of how quickly issues are getting fixed, which fixes would resolve the most problems, and where the biggest gaps are.
• Reports — The final output from a team's effort to uncover their compliance and risk exposure.
• Findings — The unfiltered culmination of all results found in one's environment for teams to analyze.
• Standards — The criteria a team's company must follow.
• Setup — The settings to get teams started that they'll otherwise rarely touch.

From the redesign two key design patterns emerged — pivot views for analyzing the data from multiple viewpoints and a content-rich side panel for details about each issue. These were the first introduction of these design patterns in the platform. Due to their success with users they became core patterns throughout the site over time.

Takeaways

This redesign laid the groundwork for future product work such as in-product remediations that work in direct correlation with resolving issues uncovered by a team's analysis. By shifting the product to be focused on users' tasks and goals, we empowered users to understand, find, and resolve the most impactful problems across their company.