Case Study

Lumenward

Lumenward is a security console for companies that use AI at work and build their own AI apps. We designed its UX and UI and made prototypes for an enterprise security software client.

Client:An enterprise security software client

Year:2025 to 2026

Industry:Enterprise security software

Services:UX design, UI design, prototypes

Platforms:Web app

Lumenward name and mark above its live traffic summary: conversations by strongest action, blocked conversations per hour and conversations by app, with sample data

The Brief

One console for the AI a company uses and the AI it builds.

An enterprise security software client wanted a console for companies that use AI at work and also build their own AI apps and agents. The brief covered the whole loop, from finding the AI in a company to watching its live traffic. We worked on it through a partner. The live traffic part shipped. The other parts are designed and prototyped.

Lumenward overview: AI tools staff use, the company's own AI systems by risk band, sensitive files sent to AI, live traffic and the items that need attention

Screens, from overview to rule set test.

Use cases: see, understand, test, fix and watch.

User roles: security head to analyst.

Solution

We designed one loop: see, understand, test, fix and watch.

A security team sees the AI in its company, opens one agent to check what it can reach, runs attack tests on an app, fixes it and then watches live traffic. The screens are redrawn for this case study. All names and numbers are sample data. Two panels were drawn for this case study to complete the story: the test setup and the approval.

Map of the Lumenward journey in five steps, see, understand, test, fix and watch, with the person and the time for each screen

01 See

Start with all the AI in the company.

The head of security operations starts on the overview. It shows the AI tools staff use, the company's own AI systems by risk band, the sensitive files sent to AI and the items that need attention first. Two views go deeper: the list of AI apps, with each risk score and progress, and the sensitive files by document kind.

List of the company's AI apps with who uses them, stage, model, risk score and progress — AI systems: apps by risk score and progress

Sensitive files sent to AI by document kind, split between AI tools at work and the company's own AI, with the settings to check — Sensitive files sent to AI, by document kind

02 Understand

Open one agent and see what it can reach.

A cloud engineer opens the agent behind the booking assistant. Its map shows the app that calls it, its model, its tools and the data it reads. Two pills mark the places where no guardrails stand. The page also lists the fix steps.

Map of what a booking agent can reach: its app, its model, two tool connectors and two data stores, with no guardrails on questions or answers, and three fix steps — What one agent can reach, and the steps to fix it

03 Test

Test an app with simulated attacks.

The app owner picks the attack types and when the test starts. The test sends thousands of simulated attacks. The results show how many got through, by attack type. Open one attack and read the whole conversation, with the reason it got through.

New test panel with 10 attack types in three groups, next to the results of the test by attack type — Set up a test, then read the results by attack type

One attack conversation in full: the simulated attacker asks the app to confirm a refund and compensation, the app agrees, and a note explains why it got through — One attack that got through, and why

04 Fix

Turn each attack that got through into a fix.

The test results lead to safer instructions for the app. The current and the suggested instructions sit side by side, and each change points to the attack type behind it. A suggested rule set of 12 guardrails follows. The data protection officer approves it before it goes on. The app page then shows its progress: connected, tested and fixes on.

Current and suggested app instructions with four changes, each linked to the attack type that got through — Safer instructions, each change with its reason

Approval panel for a rule set of 12 guardrails, next to the suggested guardrails with their sensitivity and action — Suggested guardrails, approved before they go on

App page with its progress steps, connected, tested and fixes on, the got-through rate for each attack group and the risk score per weekly test — The app with its fixes on

05 Watch

Watch what the guardrails stop, as it happens.

Live traffic shows each app's conversations and what the guardrails did with them: allowed, flagged, cleaned or blocked. Open a blocked conversation in place to see the question, the model answer that was not sent and the reply the customer saw. Try a rule set replays a question from live traffic with and without guardrails.

Blocked conversations for one app, with one row open: a refund question, the model answer that was not sent and the reply the customer saw — A blocked conversation, opened in place

Try a rule set: a sample refund question checked in four steps, with the model answer blocked and the safe reply shown — Try a rule set on a question from live traffic

06 System

One system behind the redrawn screens.

For this case study we drew all screens in one system. A warm stone page holds white work surfaces, and one spruce green is the accent. Risk bands and actions have their own colors, and nothing else does. Hanken Grotesk sets the text. JetBrains Mono sets ids, paths and instructions.

Lumenward design system: colors, Hanken Grotesk and JetBrains Mono type, risk and action chips, score scale, progress steps, buttons, a conversation turn and an instruction change — Colors, type and parts used on all screens

07 Outcome

The live traffic part shipped.

Webus designed the UX and the UI and made the prototypes. The other parts went to the client as designs and prototypes. Every name and number on these screens is sample data.

Your project