Acropolis Care Nexus — Intelligent Staffing, Better Matches, Better Care
Security teams face an overwhelming volume of alerts, fragmented tools, and limited context — making it hard to identify what truly matters.
Role
Lead UX Manager
Timeline
16 weeks · 2025
Team
4 Product Designers, 2 UX Researchers, 1 UX Writer, 1 Product Director, Security SMEs, Engineering
Primary metric
46% ↓ alert noise · $2.1M+ annual savings
OVERVIEW
The snapshot
Challenge
Security teams received 18,000+ alerts per day from disconnected tools, with 72% flagged as false positives — the noise buried real threats and slowed analysts down.
Approach
Ran a 16-week UX research and design engagement — unifying data, applying AI-driven prioritization and explainability, and redesigning investigation workflows so analysts could focus on real threats.
Result
Cut alert noise by 46%, reduced mean time to respond from 2h 14m to 14 minutes, and lifted analyst productivity by 37% within the first quarter.
HERO METRIC
46%
Reduction in alert noise, end to end
PROBLEM
What was breaking
A compliance workflow so confusing, 1 in 3 users abandoned it mid-form.
A compliance workflow so confusing, 1 in 3 users abandoned it mid-form.
Escalations delayed an average of 2h 14m, letting critical threats sit unattended
We aren't short on data. We're drowning in it. — CISO, Global Enterprise
DISCOVERY
How I learned it
Discover: stakeholder alignment & tool audit
Explore: 24 analyst interviews & contextual inquiry
Observe: investigation shadowing & workflow mapping
Synthesize & validate: co-design workshops with SMEs
Analysts use 5–7 tools per investigation, losing context between handoffs
Found in 32 shadow sessions & 24 analyst interviews
18,000+ alerts ingested daily, with 72% identified as false positives or low priority
Found in review of 87 SIEM rule sets & 1,248 sampled tickets
58% of investigations involve unclear ownership, with escalations delayed 2h 14m on average
Found in workflow observation across the SOC
INSIGHTS
The moments things clicked
Alert overload reduces signal quality
High alert volumes and false positives overwhelm analysts and hide real threats in the noise.
Context lives across too many systems
Critical information is scattered across siloed tools, forcing analysts to piece together the full picture.
Analysts lack confidence in prioritization
Risk scoring lacks transparency, so analysts second-guess and re-validate what the system already checked.
STRATEGY
How I chose what to build
Show the why, not just the score
Every AI-driven risk score ships with an explainable reason code, so analysts can trust and act on it without re-checking.
One pane, not seven tools
Unify telemetry, identity, and threat intelligence into a single contextual investigation view.
Guide the handoff
Structured ownership and escalation rules replace ad hoc handoffs so nothing falls through the cracks.
THE TRADE OFF
We prioritized alert prioritization and AI explainability first — the fastest path to reducing noise without asking analysts to trust a black box. Unified context and end-to-end workflows followed once that trust was established, since they required deeper integration across 12+ security tools.
SOLUTION
The final shape of things
1
Matches ranked by more than a resume
The matching engine weighs skill match, availability, credentials, experience, and location, then shows recruiters exactly why a candidate ranked where they did.
2
One queue, not eight systems
Every open request, its top matches, and its status now live in a single queue recruiters can act on directly.
3
Hospitals see status, not just a request form
Hospital admins get real-time visibility into fill rate, credentialing status, and consultant availability — no more waiting on an email.
IMPACT
What actually shifted
46%
Alert noise reduction
90%
Faster threat response
28%
False positive reduction
37%
Analyst productivity improvement
BEFORE
8.7 days average time to fill
2h 14m mean time to respond
12 tools in daily workflow
AFTER
3.6 days average time to fill
14 minutes mean time to respond
5 tools unified into one platform
Acropolis Care Nexus has transformed the way we staff our facilities. We're filling more shifts, faster, with the right people — and our teams can finally focus on what matters most: our patients.
CISO, Global Enterprise
Curious how this could apply to your system?
REFLECTION
What I'd carry forward
What I'd do differently
I'd bring engineering into the explainability work even earlier — trust in the AI turned out to be as much a design problem as a modeling one, and co-designing the reason codes from week one would have saved rework.
What this taught me
Great security products don't just process more data — they help people make better decisions, faster. The real problem was never the UI; it was a broken system underneath it. Fixing the system unlocked the right interface.