Golem is an external application security testing platform. It assesses websites, web applications, iOS applications, and Android applications for vulnerabilities, without requiring access to the underlying source code. I led product design across the full customer experience.
Role
Lead Product Designer
Year
2024
Industry
Cybersecurity
Platform
Web · iOS · Android
The Problem
Most organizations don't know how exposed their digital products are until it's too late.
Security vulnerabilities in websites, web applications, and mobile apps are often only discovered after an incident. Traditional security assessments can be slow, expensive, and require handing over source code, a barrier many organizations aren't willing or able to clear.
Golem approaches the problem differently. It assesses applications the same way an attacker would: from the outside, without needing to know how the product was built.
Design Challenge
The design challenge wasn't simply "how do we build a security dashboard?" It was: how do we make sophisticated external security testing understandable and useful across fundamentally different kinds of digital products?
A customer might be assessing their company website, a SaaS web application, an iOS app, or an Android app. The experience needed to accommodate all of these without fragmenting into four separate products. At the same time, the customer always needed to understand the same things regardless of what they were testing:
What are we testing? What did Golem discover? Where is the vulnerability? How serious is it? Why does it matter? What should we address first?
Approach
I started from the customer's perspective rather than the technical architecture. The workflow, add a target, run an assessment, review findings, act on them, needed to feel the same whether the target was a website, a web app, or a mobile application. Cross-platform consistency was a design requirement from the start, not an afterthought.
A significant part of the design work was around how findings are communicated. Security vulnerabilities are only useful if the customer understands them. I focused on information architecture that separated what was found from where it was found, how serious it is, and why it matters, presenting findings as clear, actionable risk rather than raw technical output.
Trust was another core consideration. When Golem surfaces a vulnerability, the customer needs to understand why it has been flagged, not just accept an unexplained warning. Transparency in how findings are presented was treated as a product value, not an edge case.
Outcome
Golem translates what is genuinely complex security technology into a clear, consistent experience that works across websites, web applications, and mobile apps without requiring customers to understand how the assessment works under the hood.
The strongest design outcome is that a customer can hand Golem a target, not their source code, and receive back a report that tells them what is exposed, where, and what to do about it. The complexity stays on Golem's side. The clarity reaches the customer.