AI-Assisted UX Engineering for Cybersecurity Products: A Design Governance Framework for Design-System Compliance, User-Flow Validation, and Pattern-Based Prototyping
DOI:
https://doi.org/10.63282/3050-9246.IJETCSIT-V7I4P101Keywords:
Artificial Intelligence, Generative AI, Cybersecurity, Product Experience, AI-Assisted Prototyping, Design Systems, User-Flow Validation, Design Governance, Usability EngineeringAbstract
In modern cybersecurity products, user experience, security, consistency, and user trust are closely interconnected, while the increasing adoption of generative artificial intelligence (GenAI) introduces new opportunities for improving early-stage product design and prototyping. AI-driven tools can help product managers convert product requirements and early concepts into initial sketches of user interfaces before involving UX designers and software developers. Even so, unchecked AI designs can stray from existing systems of organizational design, fail to capture relevant journeys of users, and create new interaction patterns that are incompatible with current product experiences. This paper proposes a conceptual approach to AI-Assisted UX Engineering for Cybersecurity Products that combines design-system governance, user-flow validation, and validated interaction patterns with generative AI-based prototyping. The proposed approach includes three complementary AI-assisted capabilities: design-system compliance, which helps prototypes adhere to the organization's design system; user-flow validation, which examines proposed experiences for completeness, alternative flows, exception flows, and security-sensitive flows; and pattern-based prototyping, which encourages the reuse of known patterns rather than creating redundant and unvalidated interaction solutions. The framework connects product ideation, AI-aided prototyping, UX design, and software development, allowing product teams to test whether initial ideas satisfy specific design and workflow requirements before moving toward formal design and implementation. An iterative validation process is integrated, where AI-generated prototypes, design-system validations, user-flow reviews, and user experience feedback are used to continuously inform further design decisions. The conceptual framework offers a structured method for leveraging GenAI as a design support tool while adhering to established UX principles and requirements of security-sensitive products. The framework needs to be empirically tested in the future to assess usability, design-system compliance, workflow coverage, prototyping efficiency, and inter-team csollaboration among product, design, and engineering teams. The proposed approach provides organizations with a foundation for integrating AI-assisted prototyping into cybersecurity product development without treating generative AI as an unconstrained replacement for established UX engineering and design governance practices.
References
[1] C. Si, Y. Zhang, R. Li, Z. Yang, R. Liu, and D. Yang, "Design2Code: Benchmarking multimodal code generation for automated front-end engineering," arXiv:2403.03163, 2024.
[2] J. Wu, E. Schoop, A. Leung, T. Barik, J. P. Bigham, and J. Nichols, "UICoder: Finetuning large language models to generate user interface code through automated feedback," arXiv:2406.07739, 2024.
[3] P. L. Gorski, S. Moller, S. Wiefling, and L. Lo Iacono, "‘I just looked for the solution!’ On integrating security-relevant information in non-security API documentation to support secure coding practices," IEEE Trans. Softw. Eng., vol. 47, no. 6, pp. 1255-1269, 2021.
[4] M. A. Madaio, L. Stark, J. Wortman Vaughan, and H. Wallach, "Co-designing checklists to understand organizational challenges and opportunities around fairness in AI," in Proc. CHI 2020, doi: 10.1145/3313831.3376445.
[5] U. O. Nwokedi, B. A. Onyimbo, and B. B. Rad, "Usability and security in user interface design: A systematic literature review," Int. J. Inf. Technol. Comput. Sci., vol. 8, no. 5, pp. 72-80, 2016, doi: 10.5815/ijitcs.2016.05.08.
[6] T. Beltramelli, "pix2code: Generating code from a graphical user interface screenshot," arXiv:1705.07962, 2017.
[7] T.-S. Kim, M. J. Ignacio, S. Yu, H. Jin, and Y.-G. Kim, "UI/UX for generative AI: Taxonomy, trend, and challenge," IEEE Access, vol. 12, 2024, doi: 10.1109/ACCESS.2024.3502628.
[8] Q. V. Liao, M. Vorvoreanu, H. Subramonyam, and L. Wilcox, "UX matters: The critical role of UX in responsible AI," Interactions, vol. 31, no. 4, pp. 28-35, Jul.-Aug. 2024.
[9] F. Di Nocera, G. Tempestini, and M. Orsini, "Usable security: A systematic literature review," Information, vol. 14, no. 12, Art. 641, 2023, doi: 10.3390/info14120641.
[10] A. M. Albarrak, "Integration of cybersecurity, usability, and human-computer interaction for securing energy management systems," Sustainability, vol. 16, no. 18, Art. 8144, 2024, doi: 10.3390/su16188144.
[11] M. Walker, L. Takayama, and J. A. Landay, "High-fidelity or low-fidelity, paper or computer? Choosing attributes when testing web prototypes," in Proc. HFES 46th Annu. Meet., 2002, pp. 661-665.
[12] J. Xiao, Y. Wan, Y. Huo, Z. Wang, X. Xu, W. Wang, Z. Xu, Y. Wang, and M. R. Lyu, "Interaction2Code: Benchmarking MLLM-based interactive webpage code generation from interactive prototyping," arXiv:2411.03292, 2024.
[13] S. Tariq, M. Baruwal Chhetri, S. Nepal, and C. Paris, "Alert fatigue in security operations centres: Research challenges and opportunities," ACM Comput. Surv., vol. 57, no. 10, Art. 240, Oct. 2025, doi: 10.1145/3723158.
[14] S. E. Schechter, R. Dhamija, A. Ozment, and I. Fischer, "The emperor’s new security indicators: An evaluation of website authentication and the effect of role playing on usability studies," in Proc. IEEE S&P, 2007, doi: 10.1109/SP.2007.35.
[15] R. W. Reeder, A. Porter Felt, S. Consolvo, N. Malkin, C. Thompson, and S. Egelman, "An experience sampling study of user reactions to browser warnings in the field," in Proc. CHI 2018, doi: 10.1145/3173574.3174086.
[16] National Institute of Standards and Technology, "Artificial intelligence risk management framework: Generative artificial intelligence profile," NIST AI 600-1, Jul. 2024, doi: 10.6028/NIST.AI.600-1.
[17] National Institute of Standards and Technology, "Artificial intelligence risk management framework (AI RMF 1.0)," NIST AI 100-1, Jan. 2023, doi: 10.6028/NIST.AI.100-1.
[18] T. Knearem, Y. Lu, S. Dutta, J. Blass, C. Kliman-Silver, and F. Bentley, "AI is not enough: A hybrid technical approach to AI adoption in UI linting with heuristics," in Proc. CHI 2024, doi: 10.1145/3613905.3637135.
[19] R. Li, Y. Zhang, and D. Yang, "Sketch2Code: Evaluating vision-language models for interactive web design prototyping," in Proc. NAACL 2025 (Long Papers), pp. 3921-3955, Apr. 2025.
[20] X. Hou, Y. Zhao, Y. Liu, Z. Yang, K. Wang, L. Li, X. Luo, D. Lo, J. Grundy, and H. Wang, "Large language models for software engineering: A systematic literature review," ACM Trans. Softw. Eng. Methodol., vol. 33, no. 8, Art. 220, 2024, doi: 10.1145/3695988.
[21] L. Franklin, M. Pirrung, L. Blaha, M. Dowling, and M. Feng, "Toward a visualization-supported workflow for cyber alert management using threat models and human-centered design," in Proc. IEEE VizSec, 2017, doi: 10.1109/VIZSEC.2017.8062200.
[22] A. Porter Felt, R. W. Reeder, A. Ainslie, H. Harris, M. Walker, C. Thompson, M. E. Acer, E. Morant, and S. Consolvo, "Rethinking connection security indicators," in Proc. SOUPS 2016, doi: 10.1145/3670009.
[23] S. Egelman, L. F. Cranor, and J. Hong, "You’ve been warned: An empirical study of the effectiveness of web browser phishing warnings," in Proc. CHI 2008, doi: 10.1145/1357054.1357219.
[24] M. Baruwal Chhetri, S. Tariq, R. Singh, F. Jalalvand, C. Paris, and S. Nepal, "Towards human-AI teaming to mitigate alert fatigue in security operations centres," ACM Trans. Interact. Intell. Syst., vol. 24, no. 3, Art. 12, Jul. 2024, doi: 10.1145/3670009.
[25] S. Amershi, D. Weld, M. Vorvoreanu, A. Fourney, B. Nushi, P. Collisson, J. Suh, S. Iqbal, P. N. Bennett, K. Inkpen, J. Teevan, R. Kikin-Gil, and E. Horvitz, "Guidelines for human-AI interaction," in Proc. CHI 2019, doi: 10.1145/3290605.3300233.
[26] D. Akhawe and A. Porter Felt, "Alice in warningland: A large-scale field study of browser security warning effectiveness," in Proc. 22nd USENIX Security Symp., 2013.
[27] Y. Acar and S. Fahl, "You are not your developer, either: A research agenda for usable security and privacy research beyond end users," in Proc. IEEE SecDev, 2016, doi: 10.1109/SecDev.2016.013.
[28] A. Adams and M. A. Sasse, "Users are not the enemy," Commun. ACM, vol. 42, no. 12, pp. 40-46, Dec. 1999, doi: 10.1145/322796.322806.
