Primary user: Cyber analyst

Assumptions:
- Technically competent
- Time-constrained
- Prefers density over whitespace
- Values consistency over novelty

Mental model:
- Scan → filter → prioritize → act
- Severity drives attention
- Confidence drives trust