Creating the first design system at Medcrypt

Establishing a scalable design system for a new cybersecurity platform

I design end-to-end product experiences and the UX systems that sustain them — from early foundations through growth, optimization, and scalability.

Initial company and product state

Initial company state

MedCrypt was a Series B healthcare cybersecurity company known primarily for its services and advisory work. While the company had deep domain expertise in medical device security and regulatory compliance, it did not yet have a mature product organization, a design team, or an established design system.

Initial product state

The product initiative was effectively greenfield. There was no cohesive UI, no shared component library, and no established interaction patterns. Early product concepts relied heavily on dense forms and ad-hoc screens, with high cognitive load and little consistency across workflows. Accessibility, theming, and scalability had not yet been addressed.

Challenge

MedCrypt needed to rapidly evolve from a services-led company into a product-driven SaaS organization—without sacrificing trust, usability, or regulatory expectations.

Key challenges included:

  • Designing a system for complex cybersecurity workflows that would grow significantly over time
  • Supporting high-stakes, regulated use cases where clarity and accuracy are critical
  • Establishing accessibility (WCAG/Section 508) as a first-class requirement from day one
  • Creating a design foundation flexible enough to support future products and features that did not yet exist

As the first designer, I needed to define not just screens, but the rules, patterns, and structure that would enable the product to scale.

Approach

I designed MedCrypt’s first design system alongside the product’s earliest features, focusing on durability, clarity, and extensibility rather than surface-level polish.

My approach included:

  • Defining a foundational visual language (color, typography, spacing, elevation) grounded in accessibility and contrast requirements
  • Establishing reusable core components (navigation, forms, tables, empty states, modals, alerts) designed for complex data and long workflows
  • Designing systematic empty states, error states, and permissions states to support real-world security scenarios
  • Creating consistent patterns for multi-workspace and multi-organization navigation, anticipating enterprise use cases
  • Supporting both light and dark modes early to meet user expectations in security tooling
  • Partnering closely with engineering to ensure components were implementation-ready and scalable

Designed the system before the products existed

Rather than retrofitting a design system onto finished UIs, I built MedCrypt’s design system ahead of full product maturity, allowing it to shape product direction instead of reacting to it.

This ensured that emerging products shared a consistent interaction model from day one.

Defined UX standards for regulated cybersecurity software

I established foundational standards for:

  • Color usage and contrast aligned with WCAG requirements
  • Typography scales optimized for dense, technical information
  • Status indicators, severity levels, and trust signals
  • Error states, warnings, and confirmation patterns appropriate for high-risk actions

Accessibility and clarity were treated as non-negotiable product requirements, not polish.

Built alignment between design, engineering, and compliance

I documented the design system in a way that engineers could directly implement, reducing ambiguity and QA cycles.

The system also became a shared language across:

  • Product management
  • Engineering
  • Compliance and regulatory stakeholders

This alignment was critical in a domain where UX decisions can carry regulatory implications.

Onboarding emails

I created new onboarding emails that aligned with security expectations and provided for the future ability to invite users.

Sign in

I was asked to create a ChatGPT-like interface, so I also identified all product features, which updated, helping to drive adoption and engagement.

Sidebar

I created the current and expected future state of the sidebar, including adding Help for the first time, helping to build trust.

Empty states

I created empty states to get people started and to value quickly.

Main navigation

The product was confusing to use and didn't provide for traceability, so I creaated a breadcrumb trail, global search, and avatar drop-down.

Breadcrumbs

The breadcrumb trail I created allowed for scalability, enabling me to quickly add on organization and workspace, as we acquired more enterprise customers with the need for more complex security.

Breadcrumb and URL structure

I pushed for breadcrumbs and URLs for traceability, mapping out the breadcrumbs and URL structure of current and future state for every use case, setting the product up for traceability to be added in the future.

Tables

Because we couldn't immediately switch from tables to a more intuitive interface for such an information-dense interface, I used a table that enabled users to customize their views, as well as creating in-page dahboards to bring the most important information forward - vulnerabilities that were new or updated, had high exploitability, etc. This was the first iteration of dashboards.

Product and product version selectors

The first thing users needed to do was select a product and product version, but this wasn't immediately clear. The selectors I created needed to allow for multiple products to be selected, as well as the ability to create, edit, and delete items.

Get started

This was the initial Get started panel when the product was still in its infancy. It was later replaced with a full-fledged Get started page, featured further below. This helped to build credibility for a product that was very limited at the time, as well as starting to establish value prop.

Get started page

This was the second iteration of the Get started experience, once I had created a help center, the product had evolved in maturity and offerings, and services had evolved. It unified our integrations offerings for the first time and brought forward other tools and upsells that were previously undiscoverable.

Colors

I created consistent color variables across both light and dark mode using Figma.

Page-specific toolbars with bulk and individual actions

Both components and vulnerabilities had the same main goals, which was to remediate the most exploitable vulnerabilities and have an accurate understanding of your overall risk. From research, we'd found that many companies just wanted vulnerability remediation to be automated so that they didn't have to spend valuable cycles on this. We now had an AI guidance system that collected security advisories and vulnerability information from many sources, so this is integrating that automation to get customers to value quickly.

Created toolbar with bulk and individual actions to get users to value quickly.

Tables: Dealing with high information density

Because we couldn't immediately switch from tables to a more intuitive interface for such an information-dense interface, I used a table that enabled users to customize their views, as well as creating in-page dahboards to bring the most important information forward - vulnerabilities that were new or updated, had high exploitability, etc. This was the first iteration of dashboards.

Table row-level actions

Instead of the user trying to guess what next action they should do, this eliminated all uncertainty.

This showed all possible next steps for a component or vulnerability.

Badges

I created a whole badge system to deal with every status, from match to remediation to license risk to lifecycle risk and beyond. Using the principle of connectivity and relatedness, this grouped several previously disparate bits of data into one unified staus. Users could click badges to resolve things like component match status.

Match status badges

Getting your components matched to known NVD software was critical to identifying the associated vulnerabilities.

Exploitability badges

This showed what was most important to focus on because it had a CISA KEV, Metasploit, ExploitDB, and other exploitability sources.

Processing modals

Processing modals showed the state of the system, how much longer an action should take, and allowing the user to continue working.

Dashboards

To get dashboards ready quickly, I used existing widgets from the ElasticSearch design system for the overview objects, which were somewhat limited, but that design system met more of our needs than other design systems. I created everything else myself.

Filters

For each table and each dashboard, I determined the categories of filters, as well as what was in each category so that users could quickly drill down on just what they needed. Only the most important filters were shown by default, using progressive disclosure for more granular filtering needs.

The filter mechanism users progressive disclosure, only showing the most important and most frequently used filters by default.

Buttons

The scalable button system provided for primary, secondary, and tertiary CTAs, as well as button groups for filtering OS lists or rescoring vulnerabilities.

Toasts and notifications

I created a toast system to ensure users always understood system status, as well as a notification center to let them easily pick up where they left off later or respond to important system or external changes, such as updated vulnerability exploitability, new vulnerabilities, automatic rescoring, and much more. I also pushed to ensure that users did not lose their work due to timeouts.

Confirmation modals with corresponding toasts

Notifications

Datasheet

I created the first product datasheet, showing how we could position the product, which enabled our sales and services team to better speak to our product's value, and to distribute at conferences.

Integrations hub

With the addition of a few integrations and our API, but low usage, I pushed for an Integrations hub to improve discoverability.

Panels

I created panels that met various needs, from one to two columns' width.

Panels with section edit

Panels in view mode needed to be editable, but allow for quick scannability.

Calendars

I created a calendar system that handled common use cases, recently used, relative time, and more.

Impact

The design system became the foundation for Medcrypt’s transition into a product-led organization.

Results included:

  • Enabled Medcrypt to ship its first cohesive SaaS product with consistent UX across features, doubling monthly release cadence
  • Scalable designs enabled me to quickly create the first UI for the newd device provisioning and certificate management UI, rolling out an MVP ina few days, as well as a new-new help center.
  • Reduced design and engineering rework by establishing shared components and patterns early
  • Provided a scalable foundation that allowed new features and workflows to be added without fragmenting the UI
  • Helped formalize Medcrypt’s product identity and credibility in a highly regulated cybersecurity market

This work set the baseline for Medcrypt’s product design maturity and supported the company’s evolution beyond services into a scalable software platform.