EndpointEventIntelligence

EMS was built to manage endpoint security, but the people who lived in it didn't trust it. I was handed a UI-consolidation project; my research showed the real problem was missing data, not layout. I reframed the work, won over a resistant leadership team with a $950K/year cost case, and shipped the feature that became the north star for every event experience across FortiClient and EMS.

In July 2024 my PM and VP handed me a defined solution: take the endpoint events EMS generated from FortiClient, then scattered across a separate view for every endpoint, and consolidate them into a single, Elastic Search powered page, grouped by endpoint. On paper it was an improvement. But shipping someone else's hypothesis without testing it isn't design. Before committing to a direction, I ran structured user research to find out whether the problem was the interface, or something underneath it.

My first interviews were oddly flat, little enthusiasm for a “cleaner events page.” Rather than take that at face value, I changed the question: instead of asking what would make events better, I asked why they were frustrated at all. That surfaced the real gap, IT administrators had no way to identify the file path for a detected vulnerability event directly in EMS. Without it, their only option was to ask end users to open FortiClient, screenshot the event details, and send it back. At scale, managing thousands of endpoints, this process could consume up to 160 hours per incident cycle.

I mapped the end-to-end journey, from scan initiation through remediation action, to expose exactly where the experience breaks and where it could be redesigned. Tap any stage to explore the action, the product response, and the pain point that became a design opportunity.

This was one of the most challenging projects I led at Fortinet, not because of design complexity, but because of the resistance. When I presented the findings, the room pushed back hard: directors and leads insisted I was exaggerating and that this wasn't a real problem. So I made it undeniable. If it weren't a problem, I argued, the three-year-old Mantis ticket one of my participants had shown me would have been fixed by now. Then I translated the friction into money: at scale, the missing file path was burning roughly $950,000 a year in manual remediation. Reframing a “UI request” as operational risk and business cost is what moved the room. With buy-in secured, we aligned on two goals:

I turned the research into a prioritized feature set and partnered with engineering through delivery. The redesigned events experience now surfaces the file path directly in the event table, no user outreach required, and lets admins save views to triage at scale. Remediation that once took 160 hours collapsed to about an hour.

What was once a fragmented, multi-day process became a seamless, end-to-end workflow. The redesign cut average remediation time from 160 hours to about one, a 42% workflow improvement validated in follow-up interviews with the original research participants and confirmed by CSE field feedback, and recovered the ~$950,000 a year the missing file path had been costing. The pattern became the north star for event-driven features across FortiClient and EMS: sales engineers now recommend it as the template, and it ships as a premium-tier capability. Its one constraint is that it requires Elasticsearch, so to lower that barrier, I added a setup tutorial that walks customers through enabling it.