Project Overview
B2B cybersecurity procurement is notoriously complex. Unlike consumer purchases, it involves long cycles, group decision-making, deep technical evaluation, and strict compliance with industry regulations. Security leaders, IT teams, procurement officers, and compliance managers all play a role, often with different priorities and limited alignment. This creates a messy, fragmented buying experience that slows down progress and introduces risk.
Cyberse set out to change that: to build an AI-powered marketplace that simplifies and accelerates the way businesses discover, compare, and purchase cybersecurity solutions.
The Challenge: Designing for High-Stakes Complexity
Cybersecurity procurement is not a linear purchase. It is a high-stakes evaluation involving multiple stakeholders, from CISOs and IT leads to compliance and procurement officers, each with their own priorities and veto power.
The product ideas existed as fragments: product listings, AI recommendations, vendor scoring. The design challenge was to bring them into a single, coherent user journey that every stakeholder could trust.
User Interview
Although Cyberse’s founding team brought strong cybersecurity expertise, we intentionally began with a clean slate: grounding the product vision in real-world user needs, not assumptions. We conducted interviews with over 10 stakeholders across industries, including CISOs, cybersecurity consultants, department leads, and internal influencers.
“I am responsible for the cyber security of the entire company, so I must ensure there is parity risks to the business.”
Maria | CISO
Despite their differences, a few shared pain points surfaced across company sizes and security maturity levels:
- 1.Uncertainty:Buyers struggle to know if they're choosing the right solutions for their specific needs.
- 2.Fragmentation: The procurement process is long, confusing, and spread across multiple teams.
- 3.Lack of Trust: Product information is often vague or biased, making it hard to evaluate vendors objectively.
- 4.Shared Decision-making: Multiple stakeholders add complexity and slow down the process significantly.
These four pain points held across company sizes and security maturity levels. They became the test for every design decision that followed: does this reduce uncertainty, fragmentation, distrust, or decision friction?
Persona and Buyer Journey
The interviews showed a buying process driven by many people in many departments, so the first structural decision was to reduce that cast to two archetypes: Decision Makers and Influencers. Two personas kept the early design tractable without pretending the process is simpler than it is. I also designed a “level chart” so the model can grow finer as Cyberse does, capturing organizational influence, budget control, and security expertise per stakeholder.
Cyberse buying committee
Two roles. One confident decision.
The product has to support both the person proving the fit and the person carrying the risk.
01 / Influencer
Finds the right fit
Influencers research the problem, compare solutions, and often start the buying process. They translate a business need into a credible technical recommendation.
- Cares about
- Technical fit, evidence, workflow impact
- Needs
- Trustworthy comparisons and a clear recommendation rationale
- Success looks like
- A shortlist they can confidently advocate for
02 / Decision Maker
Makes the call
Decision Makers own final approval and budget. They weigh cybersecurity choices against business risk, regulatory requirements, and company-wide priorities.
- Cares about
- Risk, compliance, budget, strategic alignment
- Needs
- A concise business case and confidence in implementation
- Success looks like
- An investment that is defensible and aligned
Shared decision signals
The handoff
The Influencer builds the case. The Decision Maker makes it defensible. Cyberse connects those two moments with shared evidence.
From security gap to approval
Non-linear, but easier to navigateDiscover
Influencer spots a security gap
Evaluate
Influencer researches and shortlists
Align
Both validate fit, risk, and evidence
Approve
Decision Maker confirms budget and direction
With the personas set, I mapped the buyer journey from the first security-gap discovery to final implementation: the touch points, decision criteria, and emotional state of each archetype at every stage. The map made one thing visible that conversation alone had not: exactly where AI could intervene usefully, and where it would just be noise.
Non-linear Journey - Cyberbuyer: Mapping emotional states and decision criteria for each archetype throughout the procurement labyrinth.
Workflow
The workflow turns the research into one navigable pathway: awareness, evaluation, purchase, feedback. It externalizes the buyers' mental models, so anyone on the team can point at the exact step where a feature earns its place. Integrated mockups show what each touch point looks like in practice.
Workflow: Orchestrating the buyer journey from initial awareness to feedback through integrated mockups.
Prototyping
A short design sprint turned the workflow into a clickable prototype, then a second iteration. The prototypes did what documents could not: they gave the founding team something concrete to react to, and disagreements about direction became specific conversations about screens.
V2 Prototype: Iterating from collective insights towards an intelligent procurement experience.
Impact and Learning
The project turned scattered stakeholder ideas into Cyberse's product direction: two personas, a mapped journey, and an interactive prototype the whole team could align around. Development started from a concrete roadmap instead of a debate. Ambiguity became structure, and the structure came from users, not assumptions.
One key takeaway: in domains as complex as cybersecurity, clarity doesn’t emerge by chance. It must be designed.
Procurement here is shaped by risk, regulation, and cross-functional influence. In that environment, personas and journey maps are not documentation; they are the tools that let UX lead product strategy. That is the lasting lesson I took from Cyberse.
