work / Deepwatch

Deepwatch: building a product and design team, and a platform customers trusted

My role

I led the product and design team at Deepwatch. I focused on building a product that delivered value to our customers, helped sales, and grew net retention and ARR.

Role: Product Design Manager
Team: Hired and led design. Managed product and design together
Results: Customer retention up 12%. ARR up through better sales demos. NPS up
Time: 2022 → 2024

Deepwatch is a managed detection and response provider. Its security operations centers watch customers’ environments around the clock, triage what fires, and tell the customer what matters. The work was real, and customers were paying for it. What they couldn’t do was see it. The customer platform was how we fixed that. When I left, Deepwatch had grown ARR to over $100M and was valued at $800M.

Building the team first

When I joined there was a product team with little to no design process, design system or strategy. Design was an afterthought. I quickly established a design practice, learned the company’s existing goals, met with teams across the organization and started talking to customers. I hired the entire design team and set the product strategy for the customer platform.

My main focus was setting the team up for success. If a task was assigned to someone, were they clear on the why? Was the problem well defined? Was the ask clear enough that their chance of success was as high as possible?

To do this, I split the platform into distinct sections, assigned each one to a designer, and paired each designer with a product manager and their engineering counterparts.

Where we started

We inherited a rough prototype the company had built before the team existed. It was mobile only, it showed a maturity score and a list of tickets, and it had no adoption. The strategy from the CPO was that a mobile-first application would set us apart from the competition. When we put it in front of a customer’s CISO, the answer was blunt.

“There is nothing in that app that I would ever need, much less download.”

A customer’s CISO, on the original app

We began to hear this feedback over and over from customers. Over the course of a few months it was clear adoption wasn’t happening, and leadership was getting frustrated.

One vision, shared by sales, product and engineering

Then the CPO left. The CTO took charge of the product team and asked us to rebuild the platform against three key metrics:

70% of our customers using the platform
Contribute to customer retention
A sales demo environment

Before anyone designed a screen, product and design started talking with customers: understanding what their pain points were, what functionality they expected to see in the platform, and what value was missing. We spent two weeks interviewing and synthesizing feedback, sharing our findings with product and engineering along the way. Product and design also met with sales leaders to understand what they needed from a demo environment: which use cases they had to walk through, and how we could build that environment to match their narratives.

The platform had to show the value Deepwatch was already delivering and struggling to show. We needed a single source of truth for what each customer’s SOC was doing for them. After speaking with customers we had a short list of high-value features we could ship immediately:

a) See every ticket, and who it was waiting on
b) See the detections running in their environment
c) Request custom detections
d) See the gaps in their coverage, and what would close them

The Deepwatch customer dashboard: mean time to notify, customer acknowledge time, techniques covered and true positives, open tickets by priority for the week, the maturity score against the Deepwatch average, and ticket details linked to ServiceNow — The dashboard: what the SOC did for you in the last 30 days, and what it needs from you.

A use case card in the content library: Managed detection and response, enabled, hunting through millions of DNS records for domain generation algorithms — The dashboard: what the SOC did for you in the last 30 days, and what it needs from you.

Strategy: bringing R&D into the company

An additional hurdle was that the product team sat in an R&D group that was separate from the rest of the organization. It had its own roadmap, its own data, and no real relationship with the people who delivered the service. We needed to address this in order to be successful.

Data before screens. Partnering with R&D’s engineering leads, we met with the SOC leads, detection engineering and the infrastructure teams to unify the data flows, so that the engineers on our team had access to the same data the SOC used. A coverage map or a ticket count is only worth showing if it matches what the analyst sees.

Product strategy for the whole company. I had our product team share the product strategy with the rest of the organization: what the platform could deliver, how it would show up in retention, and how sales could use it. Once SOC leadership and sales saw their own work reflected in it, they became its advocates.

Feedback from the people who knew. We started developing product advocates on the SOC team, then in sales, and eventually among customers themselves. Their feedback and insight became invaluable.

Customers were the hardest. Transparency and data integrity had historically been real sore spots, and a platform that promised both had to prove it. We did that by showing the uncomfortable numbers too: coverage that wasn’t there, tickets waiting on Deepwatch, and how each customer compared with the average. One small thing we started to show was the good news. So many customers told us that every time they used a vendor’s tool, it was bad news. So we started showing the successes alongside the critical warnings.

Detection coverage in Deepwatch: a MITRE ATT&CK grid of covered, not covered and unavailable techniques, with settings to compare against your industry, a similar Splunk license size or the average of all Deepwatch customers, which this customer covers 47% of — Detection coverage, mapped to MITRE ATT&CK and compared with the average Deepwatch customer. The gaps are the point.

The MITRE coverage map with overlay options open and a kill chain drawn across it: compromise accounts, replication through removable media, exploitation for credential access, deploy container — A real kill chain from the customer’s environment, overlaid on the coverage map, and the tickets the SOC raised along it.

Under the coverage map, the techniques seen in the environment: how often, what the squad did about each, when it was first and last seen, its severity and the associated tickets — A real kill chain from the customer’s environment, overlaid on the coverage map, and the tickets the SOC raised along it.

Impact

After a scaled rollout, the platform was a real success within a year and a half.

Customer retention increased by 12%
ARR grew, with the demo environments now part of every sales cycle
NPS rose as transparency improved, and with it the overall perception of Deepwatch
R&D stopped being a separate team and became part of the wider company

What I took from leading at Deepwatch

Hire generalists, then give them real ownership. People grow fastest when they own a problem, not a deliverable. Both of my hires were promoted because they could point at an area of the product and say it was theirs. Empowering the team also meant they could make decisions without always checking with me, which let the team move faster.

Feedback has to be direct and frequent. A weekly critique with the work on the wall did more for quality and for careers than any review cycle. I’d rather give a specific, slightly uncomfortable note today than a vague one next quarter.

The org chart is part of the product. The best design decision we made at Deepwatch was unifying R&D with the rest of the company. No screen would have earned customers’ trust while the team behind it was working from different data than the SOC.

All the lessons I learned here were instrumental in my later successes.

Visit Deepwatch Next Project