PROJECT / SAMPLE
More findings weren't making them safer.
A security engineering pipeline normalized, deduplicated, enriched, and routed findings from several scanners.
- Date
- 2026-03
- Type
- security / automation
- Status
- fictional fixture
- Published
- prototype only
Problem
A technical team spent most of its security time reconciling duplicate scanner output instead of fixing exploitable weaknesses.
Constraints
- Scanner sources and ticketing systems had to remain in place.
- Automatic closure required traceable evidence.
- Business context mattered more than generic severity labels.
Observed
- The same weakness appeared under incompatible identifiers.
- Asset ownership and runtime reachability were absent from scanner output.
- Ticket state drifted from the underlying finding lifecycle.
Work
- Unified finding normalization across sources.
- Added deterministic fingerprinting and deduplication.
- Enriched findings with ownership and exploitability context.
- Synchronized ticket creation, suppression, and closure.
- Used model classification only for ambiguous descriptive context.
Decisions
- Keep deduplication deterministic and explainable.
- Separate vulnerability evidence from prioritization policy.
- Require a source trail for every automated lifecycle change.
Result / SAMPLE
The team saw a smaller, more accurate queue and spent substantially less time on duplicate or context-free findings.
- ~1,800 findings/month normalized
- 74% duplicate/noise elimination
- manual triage workload −68%
What we did not do
We did not ask an LLM to make final risk decisions. Ambiguous language benefited from assistance; evidence and policy remained explicit.
Technical index
security scanners / ticketing APIs / risk enrichment / workflow automation