- JULY 2026 TO SEPTEMBER 2026 -
ADAPTIVE-SECURITY
ADAPTIVE SECURITY OFFERS UNIFIED SECURITY TRAINING, EMAIL SECURITY, AND AI GOVERNANCE BUILT FOR THE AI ERA.
While leading product-led growth initiatives at Adaptive Security, I identified an opportunity to make the newly launched Email Security product’s value visible throughout the admin app experience. Email Security was confined to its own product surface, disconnected from high-frequency workflows admins had already used for Security Awareness Training (SAT) in-app. To better connect SAT and Email Security, part of Adaptive’s broader unified-platform mission, while also introducing Email Security to existing customers who hadn’t purchased it, I developed a cross-product growth strategy that embedded Email Security throughout the platform. The work positions Email Security as a layer that enriches how admins understand org-wide exposure, create training content, and prioritize human risk across Adaptive.
TOOLS USED
Notion
Figma
Claude Code
Notion
Figma
Claude Code
CATEGORY
Growth Design Case Study
Growth Design Case Study
DELIVERABLES
Product Growth
UX/UI Design
Coded Prototypes
Product Growth
UX/UI Design
Coded Prototypes
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
PRODUCT-GROWTH
EMAIL SECURITY CREATED A NEW EXPANSION OPPORTUNITY WITHIN ADAPTIVE’S EXISTING CUSTOMER BASE...
Adaptive had recently launched Email Security, while Security Awareness Training (SAT) already had an established base of customers. Introducing this new product within recurring SAT workflows in the admin app created an opportunity to drive product discovery and expansion among existing customers. One-and-done onboarding or generic promotional placements in-app would increase awareness, but would not effectively explain why Email Security improves an admin’s day-to-day.
So, to create contextual paths from SAT into Email Security, the goal was to repeatedly demonstrate its value at recurring moments of intent, route interested admins into the product experience, and build a reusable foundation for future cross-product growth opportunities.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
PRODUCT-GAP
EMAIL SECURITY AND SECURITY AWARENESS TRAINING OPERATED AS SEPARATE PRODUCT EXPERIENCES...
SAT measured employee preparedness through simulations, training, and risk scoring, while Email Security identified real attacks reaching these same employees. However, Email Security’s intelligence layer was largely confined to its own product surfaces, disconnected from SAT workflows admins used to create content, understand risk, or determine who required intervention. As a result, simulations and AI-generated content could not draw from active attacks, while Risk excluded real-world targeting and whether leaders were actually being impersonated. Uniting the products would turn real attacks into actionable signals across training, content, and risk.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
THE PROPOSAL
EMBEDDING EMAIL SECURITY'S INTELLIGENCE WITHIN RELEVANT SAT WORKFLOWS WOULD DRIVE STRONGER PRODUCT DISCOVERY AND EXPANSION THAN A GENERIC UPSELL. THE STRATEGY FOLLOWED 3 CORE PRINCIPLES:
1. CONNECT EVERY EMAIL SECURITY GATE TO REAL IN-APP UTILITY
After purchasing and "unlocking" Email Security, every experience needed to be a valuable capability improving SAT-specific workflows.
2. MAKE MISSING VALUE CLEAR AND INTUITIVE TO UNDERSTAND
Before Email Security is purchased, locked experiences need to explain what the product could reveal through clear copy, layouts, and labels.
3. PRESERVE THE ORIGINAL TASK AT HAND
Admins without Email Security purchased should still be able to complete their workflow, without the in-app upsell being a blocker.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
CONCEPT-MAPPING
I PRIORITIZED MOMENTS WHERE REAL-THREAT DATA COULD MATERIALLY IMPROVE AN ADMIN’S DECISION.
SURFACE
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
a. Dashboard
b. Scenario Library
c. AI Content Studio
d. Employee Risk
e. Executive Risk
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
a. Dashboard
b. Scenario Library
c. AI Content Studio
d. Employee Risk
e. Executive Risk
ADMIN’S QUESTION
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
a. What attacks reached us?
b. What should I simulate next?
c. What should shape this content?
d. Who is actually being targeted?
e. Who is impersonating leadership?
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
a. What attacks reached us?
b. What should I simulate next?
c. What should shape this content?
d. Who is actually being targeted?
e. Who is impersonating leadership?
EMAIL SECURITY VALUE
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
a. Reveal identified and unreported threats
b. Generate scenarios from real attacks
c. Add company-specific attack context
d. Add real exposure to Risk Scores
e. Surface exec impersonation attempts
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
a. Reveal identified and unreported threats
b. Generate scenarios from real attacks
c. Add company-specific attack context
d. Add real exposure to Risk Scores
e. Surface exec impersonation attempts
Each integration paired a locked state upselling Email Security with an unlocked state that made the intelligence functional after purchase.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
RAPID-PROTOTYPE
AFTER DEFINING THE FEATURES AND PRODUCT GROWTH STRATEGY, I USED CLAUDE CODE TO RAPIDLY PROTOTYPE ENTITLEMENT STATES, MODAL BEHAVIOR, CROSS-PAGE ROUTING, AND DISABLED INTERACTIONS SO I COULD EVALUATE THE CONCEPTS AS A CONNECTED SYSTEM BEFORE INVESTING IN DETAILED VISUAL REFINEMENT:
EMAIL SECURITY UPSELL MODAL
DASHBOARD REAL THREAT EXPOSURE
SCENARIO LIBRARY: REAL THREATS
CONTENT STUDIO: REAL ATTACK DATA
RISK: REAL-WORLD TARGETING
EXECUTIVE RISK: IMPERSONATIONS
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
FINAL SCREENS
WITH THE STRONGEST CONCEPTS PROTOTYPED THROUGH CLAUDE CODE, I DESIGNED PIXEL-PERFECT FIGMA SCREENS, ALIGNING EACH INTEGRATION WITH OUR DESIGN SYSTEM:
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
FINAL SOLUTIONS
AFTER FINALIZING THE INTERFACE SCREENS, I PROTOTYPED THE FINAL INTERACTIONS FOR ENGINEERING HANDOFF, WITH FIVE CONNECTED INTEGRATIONS ACROSS THREAT VISIBILITY, CONTENT CREATION, AND RISK PRIORITIZATION TO IMPROVE THE ADMIN EXPERIENCE WHILE ALSO UPSELLING EMAIL SECURITY TO CUSTOMERS WHO HADN’T PURCHASED IT YET:
1. SUPPORTING GROWTH SURFACE: LOGIN SCREEN
Every admin encounters the login screen before entering the platform, making it a high-impression surface for Email Security discovery. To start product discovery before an admin even signs in, I designed a banner showing how Adaptive analyzes signals existing filters may miss, with a “Run a free scan” CTA to provide a low-friction path to experience the product’s value.
Every admin encounters the login screen before entering the platform, making it a high-impression surface for Email Security discovery. To start product discovery before an admin even signs in, I designed a banner showing how Adaptive analyzes signals existing filters may miss, with a “Run a free scan” CTA to provide a low-friction path to experience the product’s value.
2. DASHBOARD REAL THREAT EXPOSURE
On the Dashboard page, I designed a top-row card surfacing the number of threats Email Security identified that were unreported by employees. It connects to a full widget showing identified, unreported, and reported threats, as well as most-targeted employees. When unpurchased and in its locked state, it routes admins to the Email Security page, which opens the upsell modal.
On the Dashboard page, I designed a top-row card surfacing the number of threats Email Security identified that were unreported by employees. It connects to a full widget showing identified, unreported, and reported threats, as well as most-targeted employees. When unpurchased and in its locked state, it routes admins to the Email Security page, which opens the upsell modal.
3. SCENARIO LIBRARY: FROM REAL THREATS
On the Scenario Library page with phishing simulations, I introduced a “From Real Threats” group, a Generate from Real Threats tile when creating a custom scenario, and a supporting banner. Admins can generate from attacks identified against their organization, creating a direct feedback loop between employee preparedness and detection. Pre-purchase, all entry points are visible, but gated.
On the Scenario Library page with phishing simulations, I introduced a “From Real Threats” group, a Generate from Real Threats tile when creating a custom scenario, and a supporting banner. Admins can generate from attacks identified against their organization, creating a direct feedback loop between employee preparedness and detection. Pre-purchase, all entry points are visible, but gated.
4. CONTENT STUDIO: REAL ATTACK DATA
For AI-generated training content, admins can enable real attack data for additional context through a simple toggle interaction. Adaptive’s intelligence then parses through core Email Security signals like targeted employees, impersonated vendors, and attack pretexts. Before purchase, the toggle is disabled with a “Requires Email Security” label.
For AI-generated training content, admins can enable real attack data for additional context through a simple toggle interaction. Adaptive’s intelligence then parses through core Email Security signals like targeted employees, impersonated vendors, and attack pretexts. Before purchase, the toggle is disabled with a “Requires Email Security” label.
5. RISK: REAL-WORLD TARGETING
Adaptive Risk Score covered simulation performance, training completion, and job-function risk, but not real-world targeting. So, I incorporated this as a fourth factor that accounted for identified threats, impersonation attempts, and interactions with malicious messages. When unlocked, score weighting redistributes so real exposure contributes without exceeding 100 points.
Adaptive Risk Score covered simulation performance, training completion, and job-function risk, but not real-world targeting. So, I incorporated this as a fourth factor that accounted for identified threats, impersonation attempts, and interactions with malicious messages. When unlocked, score weighting redistributes so real exposure contributes without exceeding 100 points.
6. EXECUTIVE RISK: IMPERSONATIONS
To show how often each leader’s identity was spoofed, who received the emails, and whether anyone interacted with them, I designed an Impersonation Attempts widget. Its placement helps admins evaluate their highest-value employees, getting information on not only whether an executive could be cloned, but whether attackers have actually tried.
To show how often each leader’s identity was spoofed, who received the emails, and whether anyone interacted with them, I designed an Impersonation Attempts widget. Its placement helps admins evaluate their highest-value employees, getting information on not only whether an executive could be cloned, but whether attackers have actually tried.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
WORKING PROTOTYPE
TOUCH ANYWHERE ON THE SCREEN TO SEE HINTS THAT DIRECT YOU TO WHERE TO CLICK TO PROCEED WITH THE FIGMA WEB PROTOTYPE FEATURES. USE ON DESKTOP FOR OPTIMAL EXPERIENCE.
The prototype showcases all of the integrations connected in the Adaptive admin app. Click through and experience Email Security’s connection to SAT within Dashboard, Scenario Library, Content Studio, and Risk, along with the upsell modal.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
VALIDATION & OUTCOME
THE INTEGRATIONS INCREASED EMAIL SECURITY DISCOVERY WITHOUT DISRUPTING EXISTING SAT WORKFLOWS.
The in-product integrations generated 22 demo requests and contributed to 12 Email Security expansions over 30 days. Because the locked states remained non-blocking, admins were also able to continue their intended SAT workflows despite the in-app upsell. Meanwhile, within 30 days of purchase, 10 of the 12 expanding customers (83%) used at least one cross-product integration. Overall, the results validated that contextual product gates could drive expansion while preserving the existing experience and delivering lasting utility.
⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
CLOSING
DESIGNING GROWTH WITHIN A PRODUCT’S WORKFLOWS, RATHER THAN AROUND IT, CHANGED HOW I THINK ABOUT APPROACHING PRODUCT-LED EXPANSION.
During this initiative, the main challenge was not finding more surfaces to advertise Email Security, but rather identifying where its intelligence could meaningfully improve admin decisions. This strategy would also easily communicate the missing value of Email Security to admins who hadn’t purchased it yet, without disrupting their recurring SAT workflows. Designing for both locked and unlocked states reinforced the idea that an upsell is only sustainable when the core experience delivers genuine value and utility post-purchase.
Rapidly prototyping each integration as a connected system with Claude Code, a change from my typical approach for early product exploration, also allowed me to efficiently evaluate entitlement states, routing, modal behavior, and cross-page interactions. I was able to then utilize Figma to refine the strongest concepts, align them with Adaptive’s design system, and bundle the final interactions for engineering to implement. Overall, this project expanded my perspective from designing individual, disconnected features to shaping how multiple products can create connected customer and business value across a platform.