Collections Case Study
In the Censys platform, Collections are a powerful feature that allows users to continuously monitor specific sets of internet assets based on custom queries. They enable security teams to track changes over time, receive alerts on new or removed assets, and maintain organized oversight of their digital footprint.
“Collections is a huge time saver. It significantly cuts down my time triaging results of my queries and the user interface is relatively intuitive. Good job on collections in particular, that, that’s something that I find very useful.”
The Problem
Through product usage data (via Pendo) and customer interviews, we uncovered a key behavior: many users were running the same searches repeatedly—sometimes daily. In fact, some power users went as far as building their own APIs to automate these searches and integrate them into external workflows.
This revealed several core pain points:
Users lacked a way to save and organize large sets of important assets or search results within the platform.
With large attack surfaces and infrastructures to monitor, it was difficult to keep track of changes over time.
Most critically, there was no simple way for users to know when something important had changed—forcing them to manually rerun queries just to stay informed.
Users and Audience
Security Analysts
Monitor, investigate, and respond to threats in their organization's external assets.
Threat Hunters
Proactively search for indicators of compromise or suspicious activity across internet-facing assets.
Security Operations Center (SOC) Teams
Track changes to an organization’s attack surface and respond to alerts.
Researchers
Security researchers and academic teams conduct data analysis, threat intelligence, and tracking trends in exposed services.
Team Structure
1 designer
1 product manager
3-4 engineers
The process.
Discovery: User Research and Competitive Analysis.
Through close cross-functional collaboration, we brought together insights from customer conversations, competitive analysis, and internal stakeholder brainstorming. We asked foundational questions like:
What should this feature be called?
Does “Collections” clearly communicate its purpose?
How do we navigate the product with this new concept?
To validate our direction, we created a structured testing script and conducted user interviews to explore whether this concept resonated with their workflows. In parallel, we explored how competitors approached similar challenges and began sketching low-fidelity wireframes to visualize potential solutions.
As we gathered feedback and tested ideas, we synthesized our findings into a clear product hypothesis and began shaping detailed documentation and design direction—laying the foundation for what would become a key feature of the platform.
Define: Scoping the Roadmap.
As excitement around the concept of Collections grew, so did the scope. What started as a single feature quickly expanded into something that would influence multiple parts of the product—navigation, exploration, alerting, and sharing functionality across users and teams.
We had a wealth of ideas: conceptual wireframes, user feedback and pathways to numerous features. We needed to bring structure and clarity to move forward effectively. To do that, we aligned cross-functional teams around a clear definition of scope, identifying all required capabilities and potential dependencies. We broke down the scope increase into discrete functionality—from navigation and asset grouping, to alerting and user collaboration—and captured it all in Aha! to track features, requirements, progress, and priorities.
This step was critical in transforming a high-level concept into a tangible, buildable roadmap—one that balanced real user needs with what could be delivered incrementally. With a clear scope in place, I was able to focus on refining and iterating the core user flow for creating a Collection, ensuring the experience was intuitive, efficient, and aligned with the value users expected from the feature.
Develop: Wireframes and Iterating.
In the development phase, I began by sketching and wireframing early concepts of the Collections creation flow, collaborating closely with the product manager to ensure the experience felt intuitive and lightweight. Our shared goal was to reduce friction—how could we make creating a Collection feel effortless, especially from a user’s natural entry point, like search results?
We explored multiple ideas, rapidly iterating on how to streamline the flow and seamlessly integrate it into existing workflows. Throughout this phase, I shared progress with the design team and stakeholders for feedback, which helped refine the user journey and identify edge cases early.
In parallel, I worked within our design system, shaping and defining new patterns where needed to maintain consistency across the platform. It was a highly collaborative and iterative process, balancing usability, technical feasibility, and design integrity to bring this new feature to life..
Beta Test and Gather feedback
I partnered closely with engineering to ensure that every aspect of the design was implemented with accuracy and intention. As features moved toward code completion, we continued refining details and uncovered additional edge cases that required thoughtful UX adjustments such as missing error states.
We conducted thorough User Acceptance Testing (UAT) to validate that the feature met all functional, visual, and usability requirements. This allowed us to identify minor gaps early and make final refinements before broader release.
To validate in a real-world context, we lined up a select group of customers to test the experience—from creating a Collection to using the updated interface and navigation to creating webhooks. Their feedback was instrumental. Notably, several enterprise clients shared they had built similar tools internally, and strongly advocated for what we were launching especially recognizing its value for smaller teams without in-house resources.
Their enthusiasm affirmed we were solving a meaningful, widespread problem and doing so in a way that made advanced asset tracking more accessible and scalable across our user base.
-
![]()
Welcome screen.
-
![]()
Create a Collection form.
-
![]()
Collection Overview.
-
![]()
All Collections.
The Result.
The launch of Collections addressed a critical gap in the platform by giving users a scalable way to organize, monitor, and revisit high-priority search results—eliminating the need for repetitive, manual queries. Users could now track evolving infrastructure and threat surfaces more efficiently, directly from the Censys platform.
Key outcomes included:
Improved user efficiency: Users reported significant time savings by being able to save and return to complex queries and datasets without rework.
Positive customer feedback: Enterprise customers validated the need for this feature, with several noting they had built similar tooling in-house and were excited to see Censys offering it natively—especially for smaller teams without engineering support.
Stronger product stickiness: Collections encouraged recurring engagement, as users began checking saved asset groups and alerts more regularly.
Foundation for future iteration: The feature also laid the groundwork for enhancements like AI integrated insights on the Overview page, expansion on alerting and notifications, collaboration tools, and integration with threat intelligence workflows.