How I directed AI adoption across enterprise Privacy, Safety & Security
Google was pushing hard to adopt AI without a shared direction. I wrote the strategy, then reshaped my team to deliver on it.
- Company
- Google · Privacy, Safety & Security
- Role
- Senior Staff UX Manager
- Team
- 30+ UX designers, researchers, engineers
- Read
- 10 min
~4.5B
users whose data the PSS organization protects
~97%
precision of the AI triage agent before it acted on its own
17%
of the security investigation queue it now resolves
~3,000
people whose work the elevated OKRs now shape
The short version
Proprietary data, interfaces and workflows omitted under NDA- Context
Google’s PSS organization protects the data of ~4.5 billion users. By 2023, cyberattacks, data exposure and regulatory obligations were growing faster than we could hire.
- Problem
Google was pushing hard to adopt AI without a shared direction. Our design process worked, but it was about to be too slow, and our users are trained to question automated output.
- What I did
With my research partner, I wrote the strategy and principles for how our organization would use AI, then reshaped my team to deliver on it.
- Impact
The strategy traveled beyond my department and some of its OKRs went near Google-wide. My team moved from Figma mocks to working prototypes.
Business problem
The defender’s dilemma
Cyber defense has a built-in asymmetry: a defender has to be right every time, an attacker only once. By 2023, that gap was widening fast. Mandiant found the average time-to-exploit fell from 32 days in 2021–2022 to five days in 2023.
Privacy and governance pressure grew alongside it. In a 2023 Cisco survey, more than a quarter of organizations had banned generative AI tools, at least temporarily, over privacy and data security risks. US federal agencies issued 25 AI-related regulations that year, 56% more than the year before, according to Stanford’s AI Index.
The industry’s answer had always been more people, and that had stopped keeping up. AI was the one lever that didn’t depend on headcount, and across Google, teams were expected to adopt it with no coherent direction.
What it cost
Historically we could hire our way out of these problems, but Ops teams doubled and tripled their rotations and still fell behind, and the trend was predicted to get worse.
- 2021–202232 days
- 20235 days
The users
A suspicious cohort
Our users are security analysts, privacy consultants, lawyers and others who are paid to be suspicious. And the stakes are high, because they are accountable when things go sideways.
Hand them AI that guesses, with no way to inspect or undo it, and you burn credibility that you can’t get back.
Solution
Direction before tools
A series of decisions in the order I made them
I built my team from one person to 32 designers, researchers, content strategists, program managers, and engineers. The team was exceptional at building with Figma, design sprints and specs, and AI was about to make it all too slow.
However, transitioning the team wasn’t easy. Across the wider organization, AI learning initiatives got mixed participation because people were expected to keep delivering on their day jobs while they learned. My team had the same pressure.
The risk to my team was that they’d stay excellent at a skill that was losing value until someone forced the change, and then they’d be changing under duress, from behind, with their roles in question.
Part of my job was making sure everyone still had one.
Decision 01 of 08
Set the core direction
Stop doing security & privacy by hand. Build and operate the technology that does it.
With my UX research partner, I wrote the strategy and principles for AI across enterprise privacy, safety, and security. My core thesis: we’d go from an organization that does security and privacy to one that builds and operates the technology that does it.
AI had to solve a real problem for the people using it, and four principles set the bar any AI experience had to clear: useful and usable, responsible, trustworthy, explainable.
Follow the company-wide push to do AI everywhere.
The push across Google was to put AI into everything with no shared idea of where it would help.
A strategy and principles for AI across all of enterprise PSS.
AI had to solve a real problem for the people using it, otherwise it was just a hammer chasing the proverbial nail.
The four AI principles
- 01
Useful, usable
Easy to intervene and reverse actions of AI.
- 02
Responsible
Alert users to potentially harmful outcomes.
- 03
Trustworthy
Clear about AI limits and confidence.
- 04
Explainable
Users can easily describe what it does.
Decision 02 of 08
Changed who we hire
Hire people who can build what they design.
I moved open headcount toward people who could build their ideas. We went from zero UX engineers to six, and new design roles now go to UX engineers and builders.
Continue hiring people who were exceptional at the old ways of working.
The team was historically built around static mocks and well-defined specs.
Move open headcount to people who build what they design.
New design roles go to UX engineers and builders who translate ideas into software.
- Before0
- Now6
Decision 03 of 08
Bet on one tool
Choose for the long term, even when onboarding hurts.
Google had three internal AI development tools and no shared default. I standardized the team on Antigravity. It wasn’t the easiest to onboard, but it was the one I thought would hold up long term. It paid off, since Google fully adopted it.
Pick the easiest tool to onboard, or let everyone pick their own.
Google had multiple competing internal development tools and no shared default.
Antigravity, for the whole team.
It was not the easiest to onboard, but it was the one I thought would hold up long term.
Decision 04 of 08
Built a way to say no
Every ‘no’ comes with a reason.
At the time, everyone was saying yes to AI, which resulted in lots of noodles thrown against the wall to see what stuck.
With a researcher and a content strategist, we built an AI Impact Framework to score proposed AI work on user value and business value against feasibility, so teams could turn down weak ideas with a reason attached.
Go with the flow and say yes to every AI proposal.
Company direction said where AI belonged, but it didn’t tell us how to prioritize work or which projects to avoid.
The AI Impact Framework.
Built with a researcher and content strategist. It scored proposed AI work so teams could turn down weak ideas.
If
is greater than
then
Decision 05 of 08
Taught it myself
Make it safe to be bad at something in public.
The first barrier to AI adoption was technical setup, so with my UX operations lead I started an AI upskilling program with coaching sessions on AI prototyping and development environments every two weeks. Each session had both learning and challenges, and encouraged people to come back with both highlights and lowlights, so it was safe to be bad at something in public. Team-wide AI tool adoption went from 34% to 100% in three quarters.
Setup friction, and learning on top of day jobs.
Org-wide AI learning weeks got mixed participation. The first barrier for my team was technical setup.
An AI upskilling program, with coaching on development environments.
Each session: some context, the tools for the day, three challenges. Everyone came back with highlights and lowlights.
- Start of the program34%
- Three quarters later100%
Decision 06 of 08
Gave the team somewhere real to build
Test ideas inside real products.
I tasked UX leads with rebuilding each product in AI tools as a working copy, one-to-one. It was a way to learn the tools, and it left us with a library of working clones with our design system built in. I cleared four days at a time for people to go heads-down, and on the fifth they showed what they’d made. Ideas that used to be too expensive to prototype, like an agent that acts on your behalf, now get built to behave like the real product.
Ideas argued in static mocks and slides.
Anything ambitious, like an agent that acts on your behalf, was too expensive to prototype.
Every lead rebuilt their product as a working clone.
Same tech stack as the real thing, with our design system built in. Four days heads-down, then show-and-tell on the fifth.
Decision 07 of 08
Backed a team member’s bigger idea
A big bet in a high-risk environment, because falling behind attackers isn’t an option.
A member of my team saw what those clones could become: a canvas and harness where people who aren’t software engineers can ship working code to production on a secure, compliant baseline. I recognized the opportunity and did the organizational work to get buy-in and make it real. It’s a big bet in a high-risk environment, and it’s still in progress. We made that bet because falling behind attackers, data protection risks, and regulatory scrutiny wasn’t an option.
A UX engineer saw what the clones could become.
A sandbox where people who aren’t software engineers can go from prototype to production.
Recognize a great idea, then do the organizational work.
Buy-in, advocacy, influence, and guidance to make it real. It’s still in progress.
Decision 08 of 08
Changed how we worked
When the prototype is the artifact, exploring and making happen together.
Once prototypes became the artifact, AI merged the ideate and build phases of our process, so exploring and making now happen in one step. To keep a dispersed team connected through that shift, I hold two-hour open critique blocks twice a week where anyone can book 30 minutes.
Four separate phases and long-form written specs.
Define, ideate, build, land. Each phase was its own step.
Three phases: define, ideate and build, land.
Prototypes replaced specs. Two-hour open blocks twice a week, bookable in 30-minute slots, give me a view across a portfolio too broad to track any other way.
Before: four phases
- 01 Define
- 02 Ideate
- 03 Build
- 04 Land
After: three
- 01 Define
- 02 Ideate and build
- 03 Land
What my decisions made possible
Once the direction, the tools, and the sandbox were in place, the work that came out of them changed how security & privacy operated well beyond my team.
Securing how people talk to agents
Letting employees instruct AI agents over company chat opened risks that didn’t exist before: someone impersonating a colleague, or tricking an agent into doing more than it should.
An agent acting on your behalf is only as trustworthy as its certainty about who’s asking. I mobilized 45-plus people across 10 teams, most of them outside my org, and in five weeks we delivered an architecture that ties every request to a verified person and device.
A triage agent that earned its autonomy
Duplicate investigations were nearly 30% of all incoming security work. The agent ran assistive-only for four months, recommending and never acting, until precision reached about 97%.
Only then did it close duplicates on its own, with every action tagged and a 90-day human verification gate behind it. It now resolves 17% of the investigation queue and is growing fast.
Human-ON-the-loop review where the risk is
AI drove an exponential increase in launches, and a review process built on manual scrutiny for every launch stopped scaling.
Now launches assessed as low risk get AI-assisted, one-click approval against set criteria, and human attention goes to the launches that warrant it. The goal is to cut time to launch by 40%.
Results
Impact of the work
What changed outside my team
The principles were written for my department and traveled well past it. I took them to VPs and senior directors myself, and some of our OKRs were elevated to near Google-wide.
My team is a little over 30 people. The organization those OKRs now shape is roughly 3,000, and none of them report to me.
AI-assisted review now handles low-risk launches with one-click approval, with the goal of cutting time to launch by 40%.
What changed inside it
Working prototypes replaced written specs, cutting the time to get product, engineering and design aligned on what to build from months to weeks. Almost nobody works in Figma anymore. Designers hand engineering prototypes built in real code, and the more technical people ship to production.
Our entire research team now works with agentic AI tools, running log analysis that used to require data science support.
What survives me
The operating rhythm. Define, ideate and build, land is how the whole team works now, and it would keep running if I left tomorrow.
I’m less sure about the training program. It’s mostly been me and a UX operations lead. What does survive is the habit underneath it: share what you learn, including what failed.
What I’d do again
The principles. I’d write them anywhere. But what works at Google would need adjusting for a different context, so I’d need to stress-test or start clean.
What I wouldn’t
I wouldn’t rebuild the AI Impact Framework. It was a large lift and right for the early days when nobody knew what AI cost, but it has run its course.
