AI-Powered Cybersecurity for Threat Prediction

Cosy started as a research project, not a product brief. The team's open-ended question was: how effectively can machine learning be used to detect and defend against cyberattacks early? Without a defined end-user, structured thinking became the primary design tool.

At its technical core, the project combined AI and game theory to predict cyber threats and to compute optimal response strategies for IoT and Industry 4.0 cyber-physical systems. My role was to translate that technical work into an interface that an analyst or manager could actually use.

Working with the project's machine-learning researchers, I built two personas on the back of their domain hypotheses about who would adopt such a tool: an administrator (deep technical context, needs to investigate and act) and an IT manager (oversight role, needs the situation at a glance). Treating domain experts as proxy users is not a substitute for full user research, but in a research phase with no production user, it was the appropriate approach.

The personas drove every information-architecture decision that followed: same model output, different information density, different primary actions. The result was a set of linked dashboards designed so each persona could open Cosy and see what their role needs to know.

A second core part of my role was making the concept concrete. At the start of the project, the proposition existed largely in technical terms: a reinforcement-learning agent producing risk signals that needed to become an interface. I worked with the team to identify which data points the model would actually surface, and to define how each one should be visualized so that an administrator or manager could read the system quickly and act on it without ambiguity.

The central design problem in Cosy was rendering the output of a complex machine-learning model legible at the appropriate level of detail for two very different user roles.

Risk score paired with directional change. The model produces a continuous risk score. In the manager view, the score is paired with a trend indicator: the current value and the percent change since the previous period. This pairing is deliberate, since manager-level decisions are typically made on the change rather than on the snapshot. A score of 156 in isolation conveys little, while a +8.1% week-over-week shift is actionable.

To keep these two readings from blurring, risk is carried by color and confidence stays a plain number paired with its track record. Two questions, two channels.

Information density adapted to the user role. For administrators, the same model output decomposes across a dashboard of up to twelve cards: CVSS-score distribution, vulnerable hosts over time, cluster visualization (pods, servers, ingress paths), node topology (sensors, cameras, routers, switches), triggered investigations, alarm assessments, and mitigation status. Administrators investigate the detailed breakdown, while managers work with the consolidated overview.

Model output integrated into the information architecture. The risk score, predicted attack paths, and detected vulnerabilities are not isolated "AI features" placed alongside a dashboard. They constitute the dashboard itself. Designing for AI in this context meant designing the information architecture first, and then placing the model output where it structurally belonged.

Cosy delivered a functional, operational software product, alongside a public dataset released as a research output. After the research phase, the team began commercial outreach, exploring the prototype as the basis for a productized offering for IT administrators in data centers.

The research line was then continued at scale. In June 2023, the same approach was extended in COBRA-5G (Container-based Resilient Architecture for 5G Campus Networks), a successor program funded by the Bundesamt für Sicherheit in der Informationstechnik (BSI) through November 2024. COBRA-5G applied the COSY approach to 5G campus networks, with a containerised architecture, OpenRAN integration, and the detection of jamming and network attacks. GT-ARC contributed the real-world laboratory in a Berlin-based autonomous-mobility infrastructure. My design work spans both phases of the line, from the initial COSY prototype to the COBRA-5G extension.

Being chosen by a second federal funder, and a different one (from BMBF to BSI), is the strongest validation a research-phase prototype can receive. It meant the design direction we set held up under independent review.

Domain knowledge. Joining a technical research team, I had to learn cybersecurity vocabulary, threat models, and 5G architecture in parallel with designing. In retrospect, I would invest more upfront in learning the domain deeply before proposing solutions, not because it is a prerequisite, but because it would have let me push back on technical decisions with more confidence.

AI-native design was still emerging. When the project started in 2019, "designing for AI" was not yet a discipline. Patterns like confidence display, uncertainty surfacing, and reasoning chains were not yet conventions. I made decisions case by case, sometimes well, sometimes in ways I would revise now. Looking back, I can see places where I could have made the model's uncertainty more explicit, and where I could have given analysts more direct ways to challenge the model.

Limited end-user access. As a research project, we worked primarily through domain-expert proxies rather than real security analysts. That was the right call given the constraints, but it left gaps in my understanding of operational workflows that I would want to close in a productized context.