NARC · Tidal Cyber · AI product design
Designing trust into an AI that changes your data.
NARC reads threat reports and suggests updates to a security team's threat library. The model was already good at pulling out the right information. My job was making it safe to let that output change data a team relies on, with a person in control of every change.
Hours to minutes
Report analysis time with NARC, per Tidal Cyber's launch announcement.
API to product
Took NARC from a developer-only API to a feature anyone on a security team can use.
Every change reviewed
Analysts choose, item by item, what gets saved.
01 · The problem
A capable model that few customers could use.
NARC started as an API. It pulled intelligence out of threat reports and mapped it to MITRE ATT&CK, the industry's standard catalog of attacker behavior. It worked, but only for customers willing to write and maintain their own integration code.
The work it replaced was slow and manual: analysts reading long reports and tagging them by hand. Tedious, inconsistent, and a good fit for a model.
Bringing NARC into the product changed the stakes. An API hands back a suggestion. A feature that saves to a team's threat library takes an action, and that library is what the team makes security decisions from.
The hard part wasn't the AI. It was letting a system that can be wrong change data people depend on.
02 · Guardrails
The guardrails came before any screens.
Product and engineering set several guardrails early, and I designed within them. Each one limited what the feature could do. Together they framed the real design question: how do you make a model's output clear enough that a person can confidently decide what to accept?
Privacy
The model only sees the report
Nothing else from a customer's account goes to the model, only the report they choose to submit.
Retention
Reports aren't kept
Threat reports can contain sensitive incident details, so submissions aren't stored after processing.
Write scope
Add, never overwrite
NARC can add details to a record, like a new country or industry, but never rewrites what a team's analysts wrote.
Saving
All or nothing
A partial save would leave data in a state nobody could reason about, so every save completes fully or not at all.
Step 1 · Analyst
Submit a report
An analyst adds a threat report by link or pasted text.
Step 2 · NARC
The AI reads it
NARC pulls out attacker groups, tools, and techniques and matches them to existing records.
Step 3 · Analyst
Review each change
Every suggestion shows its source and what will happen. The analyst picks what to keep.
Step 4 · Analyst
Save all or nothing
The chosen changes are saved together, or none are, and NARC's changes are marked.
03 · Key decisions
Four decisions that shaped the experience.
Transparency
Show people what the AI did.
Early on, I pushed for marking every record NARC created or changed. It didn't make the first cut. I kept making the case: if analysts can't tell which records came from a model, they can't check them or decide how far to trust them.
By launch, it was in. The release added a "last modified by NARC" marker and a view of every record NARC had touched. That view also let the team show customers what NARC had done for them, and having both reasons is what got it over the line.
Clarity
One column, one question.
Testing before launch exposed the biggest usability problem. A single column tried to say both where a record came from and what NARC would do to it. When several records shared a name, people couldn't tell whether NARC would create, update, or skip one.
With the product lead and an engineer, I split it into two columns: source and action. Smaller fixes followed. A placeholder that read "<object to be created>" became a simple "New" tag, and the button during processing changed from Cancel to Abandon, because Cancel promised an undo the system couldn't deliver.
Safety
Remove a feature rather than ship a risky one.
Search in the review table had a hidden flaw: filtering could quietly deselect items someone had already chosen and could no longer see. A person could search, save, and apply different changes than the ones they meant to approve.
We removed search and moved it to the backlog. A table without search is a weaker feature. A table that silently changes what you're about to save is a broken product.
Naming
A name that leaves room to grow.
An early proposal called it "NARC AI Report Analyzer." I pushed for "NARC AI." The longer name tied the feature to one kind of input.
Since launch, NARC has grown to accept PDFs and to produce exports and focused campaigns. The shorter name still fits.
04 · Beyond NARC
The pattern outgrew the feature.
The review pattern from NARC (show every suggested change and let people decide what to keep before anything is saved) now shapes other places where new intelligence changes a customer's data. The What's New experience uses it, and so does the flow for adding new threat intelligence to new or existing threat profiles.
A pattern that carries across features is worth more than any single screen.
05 · What I took from this
Lessons that carry beyond security.
An AI that takes action is a different product from one that answers questions.
Human review, clear labels, all-or-nothing saves, and no silent rewrites aren't AI features. They're what it takes to let a system that can be wrong change data people rely on, in any industry where AI moves from suggesting to doing.
Transparency about AI has more than one audience.
Users need it to trust the output. The business needs it to show the value. The case is strongest when it speaks to both.
Sometimes the safer design is removing a feature.
When the output changes someone's data, incomplete beats quietly wrong.
Names are architecture.
A label that locks in today's scope gets expensive to change later. Choosing a broader one cost nothing at the time.
06 · What I'd do differently
I'd make the case for marking AI-made changes to more than one audience from the start. I first argued it on user trust alone. Bringing the business benefit into that first conversation would likely have gotten it in sooner.