Findings from Nessus, Semgrep, Trivy, and Snyk were stored in per-scanner shapes. Dedup, severity normalization, and cross-tool reporting were manual and unreliable. Adding a new scanner took an average of three weeks.

Built an ingestion API with a normalized finding schema, per-scanner adapters, and Kafka fan-out to Elasticsearch for search and Postgres for canonical storage. Deterministic finding-fingerprints made dedup trivial across scanners.

Onboarding a new scanner dropped from three weeks to two days. Analysts stopped writing cross-tool SQL and started using the search endpoint. Coverage went from three scanners to seven within a quarter.