The skills-gap framing and designing for analysts at every level was right. But we arrived at it through iteration rather than starting there. Early on, the experienced analyst was the assumed primary user, and our research sessions skewed toward senior SOC engineers who could articulate workflows fluently. The junior analysts we eventually designed for were harder to recruit for research and less likely to challenge a prototype. If I were starting again, I'd establish the full range of expertise as the primary design constraint from day one and structure research to deliberately weight the less-experienced users who are hardest to reach but whose needs most directly test whether the design is actually working. This research lesson is now something I coach junior designers on.

I also underestimated how much the PICERL framing would matter for stakeholder alignment, not just for the analysts. Grounding the design in a framework that security leadership already trusted made the design rationale legible to people who weren't in the room for the research. That's a lesson I now apply everywhere: choose a structural metaphor your stakeholders already believe in, and the design sells itself.