Context
Prelude’s founders came out of MITRE, where they built CALDERA, the open-source adversary emulation framework. They could build attack infrastructure most security companies can’t. What they’d shipped was a tool only they could run. Operator put every concept in adversary emulation on screen at once: agents, chains, ATT&CK techniques, schedules, results. A security engineer seeing it cold had nowhere to start.
They were heading into a raise. The product had to be something an investor could watch a stranger use. I was the first designer, full-time, January to July 2022.
Contribution
I didn’t draw anything at first. I’d done offensive security work on my own time, so I could read ATT&CK, but I didn’t know how an operator actually plans a campaign. I sat in on their sessions and drew their mental model: a chain is a sequence of procedures, each procedure hits an agent, each agent lives on a host, and results have to point back at the chain that made them. Every screen in Operator follows that drawing.
The big call was progressive disclosure instead of a flat canvas. The founders wanted every parameter visible because that’s how they worked. I pushed for the first screen to show only the shape and status of the chain, with procedure config one level down and raw output below that. Experts lost speed: someone who knew exactly what to tweak now needed two clicks instead of zero. I took that trade because the plan was to sell to engineers who didn’t write CALDERA.
Second call: emulated and live attacks look different everywhere. Color, icons, confirmation copy, all of it. It made the interface heavier and the design system harder. A red team tool that lets you run the real thing by accident is a liability, and nobody argued once I put it that way.
I also set up the first design process the company had: a decisions log, a weekly review with engineering, and component docs that outlived me.
Outcome
Prelude raised a $24M Series A led by Sequoia in April 2022, with Insight and IA Ventures in the round. They’ve since raised another $16M and moved toward endpoint security. I’m not going to claim the interface closed the round. I’ll say the version investors saw was the one above, and that an engineer who’d never touched CALDERA could build and run a chain without help. That was the brief.