Sentra is a self-initiated concept: an AI copilot that helps security analysts triage, investigate and respond to attacks — while every decision stays in the analyst’s hands.
Live demo · sample data
Security Operations Center (SOC) analysts are the people who catch cyberattacks while they happen. During a shift they triage hundreds of alerts from many tools. Most of them turn out to be noise, but missing the one real attack can cost a company millions.
Sentra is a concept for an AI copilot that sits next to the analyst. It groups raw alerts into incidents, ranks them by risk, explains in plain language what happened, and proposes how to respond. The analyst stays in control of every decision.
Two user types: Tier 1–2 analysts, who triage and investigate on shift, and SOC leads, who approve high-impact actions and changes to detection rules.
The brief I set myself: design an AI experience that makes analysts faster without asking them to trust a black box.
01Problem
Too many alerts, too little context
Analysts lose most of their shift dismissing false alarms and jumping between 5–6 tools to rebuild what happened. Existing AI features often make it worse: a confident score with no explanation is one more thing analysts have to double-check.
02Solution
An AI that shows its work and asks before acting
Sentra turns alerts into ranked incidents, writes a plain-language summary with a confidence level, links every claim to the raw evidence, and suggests a response plan. Nothing that changes access, blocks traffic or edits rules runs without explicit human approval.
03Outcome
A live prototype and a set of AI behavior patterns
The concept covers the core analyst loop (see, understand, respond) plus the states that usually go undesigned: AI still analyzing, AI unsure, AI wrong. Success would be measured by time to respond, the share of AI suggestions accepted vs. corrected, and analysts’ self-reported trust.
Before any visual design, I mapped where things live and how people move through them. Two people, one product: Simple view walks a non-technical person through one decision at a time; Expert view gives an analyst the same steps with full detail.
Low-fidelity wireframes of the final structure, with the reasoning, earlier versions and open questions written next to each screen.
1 / 3
See every screen and state in the Figma file (opens Figma in a new tab)
01
Sentra turns each problem into one plain question with a clear yes. When it proposes a fix, every step says what will happen and whether it can be undone, before anyone approves it.
Each step runs only after the analyst approves it, and changes to access policy wait for the team lead. Approval is a deliberate click, never a default.
02
Every reason Sentra gives opens to the raw log record behind it, and Sentra says how sure it is: in words in Simple view, as a number in Expert view.
Simple view keeps the depth one click away. Expert view shows the full analyst layout, where severity is encoded by badge style, icon and label, not by color alone, so it stays readable for color-blind analysts and in both light and dark themes.
03
When data is missing or the AI is unsure, Sentra says so, shows competing hypotheses, and hands control back.
When an analyst corrects Sentra, the feedback is structured. What Sentra learns becomes a suggested habit that waits for the team lead, and Sentra recommends rejecting any habit that would have hidden a real attack. That makes the learning loop visible and reversible.
01
Never afraid to click
Sentra suggests; nothing that changes access, blocks traffic or edits rules runs until a person says yes.
02
Plain words first, proof one click away
Every claim opens to the evidence behind it, and Sentra says how sure it is.
03
Admit what you don’t know
When Sentra is unsure or wrong, it says so, hands control back and learns only with a lead’s approval.
v1Figma screens
A classic SOC dashboard on shadcn/ui. Self-critique: it looked like a typical admin template, and the AI was a card on top instead of part of the work.
v2Live prototype
Rebuilt in code around decisions instead of metrics, with an inbox of decisions, evidence links and approvals.
v3Guided mode
One task at a time, plain language, and Expert view one click away, so non-technical people can act with confidence without losing depth for analysts.
A concept that treats trust as the core UX problem of AI in security, not an afterthought.
Sentra is now a live, clickable prototype with sample data, built on shadcn/ui, with a Simple (Guided) view and an Expert view of the same product. It’s checked for WCAG AA text contrast, with severity shown by badge style, icon and label rather than color alone. The most valuable part isn’t the happy path but the edge states: how the product behaves when the AI is slow, unsure or wrong. Next I’d validate the concept with practicing SOC analysts: run moderated sessions on the investigation flow, test whether evidence links actually change trust, and measure how often analysts accept, edit or reject AI suggestions.