Intense data made accessible
Network systems information & management design discovery work for Cisco's ThousandEyes product.
The data was never the problem.
ThousandEyes measures the path from every office to every app, every few minutes: tests, agents and every hop in between. The data is complete. The answer is buried in it.
I joined a small team at Cisco to set a vision for where the platform could go. The thread through all of it: make dense, complicated data readable by the person who has to act on it.
Four people, one network.
Is it us?
Lee gets the tickets first. She needs a verdict she can repeat to everyone waiting, before the queue grows.
What changed?
Beck owns the switches. He needs the change, the timeline and what it could touch, side by side.
Where do I set that up?
Sam is opening new offices. He knows the job; he should not need to know the feature’s name.
Are we covered?
Once a month, one page: reliability, gaps and the decisions to make, in plain words.
Six rules for dense data.
Every screen and board here follows the same six rules. Together they decide what the eye reads first.
Answers before dashboards.
A plain verdict leads; the charts that prove it sit one click behind. Nobody should read a dashboard to learn the network is fine.
Tiers of detail, one toggle.
Glance, pattern, every hop: three tiers on the same data, so depth is a choice, not a different tool.
Quiet when healthy.
Healthy recedes to grey. Colour is spent only on change, gaps and failure, so the eye lands where the work is.
One axis per chart.
Different units get separate charts on a shared clock, never a second scale that makes two lines look related.
Status means state.
Status colour always travels with an icon and a word, and never doubles as a category. It reads in colour-blind vision, in print, in light and dark.
Compare against normal.
Change is measured against each office’s own typical hour, so a busy Monday morning stops looking like an incident.
One dataset, six forms: the same 1,824 latency values answer six different questions.
Quiet when healthy: a full day of tests stays grey, so three incidents are the only colour on the ring.
Compare against normal: fourteen offices ran 35 ms slower than their own baseline, and nothing failed.
The network, drawn in detail.
Three boards at three altitudes: one request in milliseconds, one day in hours, one route change seen from orbit.
Where 412 milliseconds go.
One page load from a laptop in San Francisco to Workday and back: five enterprise devices, six internet hops in three networks, every millisecond placed.
Anatomy of a request: one transaction, segment by segment.
Twenty-four hours on one dial.
Three incidents on a clock face: the route change in the afternoon, the switch change rolled back overnight, the outage still open in the morning. Night is shaded, so three in the morning never reads like rush hour.
One day of the network: a radial day with event pins and a how-to-read key.
A detour you can see from orbit.
For 50 minutes, paths from 14 offices across Europe, the Middle East and Africa swung south through Miami on their way to Workday, adding 35 milliseconds. Nothing failed; everything slowed, and the map shows why in one look.
One route change: great-circle paths on a dot map, with the networks carrying them before and after.
Beyond the desktop view...
An incident does not wait for a desk. The same answer scales down to a phone and a watch: the verdict first, the failing segment named, the proof one tap away. Nothing new is invented for the smaller screen.
Five moments on the wrist: glance, tap, verdict, replay, ask. A Live Activity opens with the incident and closes when it ends.
The verdict in one sentence, and the Digital Crown scrubbing the last five minutes.
Desktop and phone, one answer: the verdict leads, and the path and the office-by-office grid prove it.
Design system
A micro design system built for ThousandEyes: colour, type and space as variables, components built from properties. Change one main component and every screen follows, in dark and light.
Ramps with jobs.
A categorical order checked for colour-blind vision, one sequential ramp for magnitude, a diverging pair around a neutral grey, and status colours that never double as categories.
Charts are components too.
Legends, heat scales, event pins, segment nodes and coverage cells are instances with properties, so a chart reads the same on every screen.
Dark & light mode
Dark for the operations floor, light for the monthly page. The theme is a variable mode on the frame, not a second file.
One screen, two modes: the theme is a variable mode on the frame, not a redraw.
The whole system on one board: foundations, controls, data display, network, chat and shell.
Colour ramps with jobs, and controls built from properties instead of one-offs.
A type ramp built for dense tables, on a four-pixel spacing scale.
Five things I would measure first.
These are concepts. Before any of it ships, these are the measures I would want.
Time to verdict falls: first ticket to a confident answer, from xx minutes today to xx.
People open the proof: the share of answers where someone opens the evidence, and whether it changes the next step.
Alerts written as sentences hold up: backtested precision against hand-built rules, across n = xx accounts.
Blind spots close: offices and apps without tests, before and after the coverage matrix.
Intent search finds the feature: first-try success by intent against the menu, across n = xx tasks.
What dense data taught me.
Density is fine. Noise is not.
People who run networks want more data, not less. What they cannot afford is colour spent on things that are fine.
The form is the argument.
The same 1,824 numbers told six different stories. Choosing the form is choosing the question.
An answer needs its evidence.
A verdict without a live view behind it is an opinion. Every answer here carries its proof.