Built for you

For security data engineering teams
who own the contract between the operational workspace and the warehouse

Security data engineering teams build, ship, and operate the pipeline that moves finding records, activity log events, exception register entries, and AI report tables out of the operational security workspace and into the enterprise data warehouse, data lake, and BI environment. The leadership dashboard, the board cyber risk briefing, the multi-cycle SLA attainment chart, the framework coverage attestation, the ownership rework analytic, and the cyber risk quantification loss curve all read against the same record but at different cadences and different join shapes. SecPortal pairs a typed findings record with CVSS 3.1 vector and severity band and status state, an append-only activity log with actor and entity grain on every workspace event, structured exception records with the eight-field decision chain, retest records paired to the original finding, scan execution records with a structured diff endpoint, AI report tables that download directly as CSV and Excel, bulk finding import for reverse-ingest of Nessus and Burp Suite and CSV, plan-driven CSV export of findings and activity and exception register, role-based access control with named service accounts, multi-factor authentication, and a verified domain registry the warehouse asset dimension reads against, so the export contract is a documented data product rather than a quarterly CSV pull the analyst rebuilds by hand.

Get Started Free

No credit card required. Free plan available forever.

A typed source record, a cadenced export contract, and an activity grain the warehouse loader can rely on

Security data engineering teams own the contract between the operational security workspace and the enterprise data warehouse, data lake, and BI environment. The leadership dashboard, the board cyber risk briefing, the multi-cycle SLA attainment chart, the framework coverage attestation, the ownership rework analytic, the lifecycle latency decomposition, and the cyber risk quantification loss curve all read against the same underlying record but at different cadences and different join shapes. Most security programmes solve this by pulling a CSV once a quarter, emailing it to an analyst, and rebuilding the dashboard from scratch every cycle. The chart drifts from the operational view, the analyst rebuilds the calculation, and the leadership read disagrees with the working dashboard.

SecPortal gives security data engineering teams a typed finding record with CVSS 3.1 vector and severity band and status state, an append-only activity log with actor and timestamp on every workspace event, structured exception records with the eight-field decision chain, retest records paired to the original finding, scan execution records with a structured diff endpoint, AI report tables that download as CSV and Excel from the report view, bulk finding import for reverse-ingest of Nessus and Burp Suite and generic CSV, plan-driven CSV export of findings and activity and exception register, role-based access control with named service accounts, multi-factor authentication, and a verified domain registry the warehouse asset dimension reads against. The export pipeline becomes a documented data product the security data engineer can ship, version, classify, and operate rather than a quarterly CSV pull the analyst rebuilds by hand.

Pipeline capabilities security data engineering teams use day to day

CSV and Excel export from every operational surface

The findings view exports as CSV with the canonical column set (finding identifier, title, CVSS 3.1 vector, severity, named owner, engagement reference, source pipeline, open date, close date). The activity log exports as CSV with the actor, the entity type, the action, the metadata payload, and the timestamp. The AI report chat surfaces structured tables that download directly as CSV and Excel for severity distribution, remediation throughput, exception register, and control coverage attestation. Each surface is a stable column projection the warehouse loader reads from rather than a fresh transformation each cycle.

Append-only activity log with actor, entity, action, and timestamp

Every finding update, scan run, retest run, exception decision, evidence upload, override change, comment, credential lifecycle event, document upload, and team change is recorded with the actor, the entity, the timestamp, and the action. Plan retention covers 30, 90, or 365 days. The event grain is the join key the warehouse fact table uses against the finding fact for lifecycle latency, time-in-state, override frequency, and ownership rework computations.

Structured finding record with severity, status, owner, source pipeline

Each finding carries the parsed CVSS 3.1 vector, the calculated base score, the severity band, the status state (open, in_progress, resolved, verified, reopened), the named owner, the engagement reference, the source pipeline (external scan, authenticated scan, code scan, manual entry, bulk import, third-party pentest), the asset reference, the framework mapping, and the override decision link. The warehouse fact table reads off a typed schema rather than a free-text payload, so column drift is detectable and the schema contract is testable.

Structured exception register with named approver and expiry

Exceptions are captured on the same engagement as the finding they cover with linked finding, severity, compensating controls, residual likelihood, residual impact, business rationale, named approver, expiry date, and review cadence. The exception register exports as a queryable cohort: the warehouse GRC tile reads off the same eight-field decision chain the operational workspace records rather than off a narrative document.

Bulk finding import for reverse ingest from scanners outside SecPortal

Bulk finding import accepts Nessus, Burp Suite, and generic CSV through a documented intake. Scanners that run outside SecPortal land their output on the operational workspace through the import workflow rather than through a backdoor connector, so the operational record stays the source of truth and the warehouse only ever reads the consolidated post-import view. The intake path is reproducible and the source identity travels on every imported row.

Role-based access control with named service accounts and MFA

Role-based access control covers owner, admin, member, viewer, and billing roles. The export pipeline runs under a named service account scoped to viewer or member as the data classification permits rather than under a personal user account. Multi-factor authentication is enforced on every account when the workspace owner requires it, and the middleware promotes sessions to AAL2 so the access model is enforced rather than asserted. The export credential is a rotation artefact captured on the activity log alongside every other credential lifecycle event.

Verified domain registry as the asset dimension source

The verified-domain registry holds the per-asset records the warehouse asset dimension reads against. Verification through DNS TXT, HTML meta tag, or .well-known file is the precondition the operational workspace enforces; the warehouse joins the finding fact to the verified-domain record by the canonical asset reference rather than by a free-text hostname column that drifts.

Scan execution records with a structured diff endpoint

Each scan execution is its own record with target, module set, started-at, completed-at, and per-module result. The diff endpoint returns new findings, fixed findings, and unchanged findings between any two executions on the same target, identifies which modules ran in one execution but not the other, and annotates every recurring finding with its current override status. The warehouse loads the diff event stream rather than reconstructing deltas in the warehouse SQL layer.

AI report tables that round-trip the analytical surface

The AI report chat surfaces structured tables for severity distribution, remediation throughput, exception register, framework coverage attestation, and the per-engagement narrative tables. Each table downloads as CSV or Excel directly from the report view, so the warehouse fact table for the leadership pack ships from the same record the operational analyst already reads against rather than from a parallel reporting pipeline.

Engineering disciplines that keep the warehouse pipeline maintainable

A warehouse pipeline that survives the next surveillance cycle operates on a small set of engineering disciplines. SecPortal makes each one a record-level practice rather than a tribal-knowledge convention the analyst rebuilds each quarter.

Treat the export pipeline as a documented data product rather than as a quarterly CSV pull. Each export class has a named owner, a documented landing zone, a schema contract version, a documented cadence, a named service account, and a data-classification rule. The pipeline incident queue reads off the same record the live operations runs on.
Run the snapshot cadence against the question the warehouse answers. Open finding snapshots typically ship weekly because the leadership dashboard reads against the same weekly rhythm. Activity log slices typically ship daily because the warehouse needs the event grain for time-in-state and lifecycle latency. Dimension exports (engagement, client, asset) typically ship monthly because the dimensions change slowly. Exception register exports typically ship weekly because exception state informs both the operational workspace and the board risk briefing.
Anchor every warehouse fact table on the typed finding record schema rather than on the free-text export filename convention. Severity band, status state, owner-of-record, engagement type, source pipeline, asset reference, CVSS vector, framework mapping, and override link are all structured columns the loader can rely on. The schema contract test runs on the export job rather than on the warehouse downstream.
Pair the warehouse fact table with the activity log event fact for the lifecycle latency, time-in-state, override frequency, and ownership rework analytics the operational workspace alone cannot compute. The 90-day Pro retention covers a quarterly retrospective; the 365-day Team retention covers an annual SOC 2 Type 2 or ISO 27001 surveillance audit window without external archival.
Classify every export column as raw, redacted, hashed, or omitted before the loader touches the warehouse. The finding description may carry raw payload, the asset binding may carry an internal hostname, the activity log slice may carry the actor on a sensitive override decision, and the exception register may carry the rationale text. Capture the decision on the export job specification and on the activity log entry the pipeline writes back into the workspace.
Document the reverse-ingest path explicitly. When the warehouse needs to round-trip a derived dataset back into the operational workspace, ride the bulk finding import workflow for Nessus, Burp Suite, or CSV rather than a backdoor connector. The operational workspace remains authoritative for the current state, and the warehouse remains the analytical surface.
Name the service account, the role, the MFA enrolment, and the credential rotation rule for every export job. The activity log captures the named actor on every workspace event, so the export run, the schema change deployment, and the data classification decision all preserve the chain back to a defensible identity rather than a shared password.
Treat the AI report tables as a first-class export class rather than as a one-off PDF copy-paste. The leadership pack table, the audit committee tile, and the board risk briefing chart all read off the same CSV or Excel pull the security data engineering team scheduled, so the boardroom number and the operator queue tell one story.

From export class to warehouse fact table, on one engagement record

The security data engineering loop runs as charter, build, contract, model, deliver, operate, classify, and hand off. SecPortal runs that loop against the typed record so the export job specification, the schema contract test, and the post-incident note all share the same workspace the live operations runs on.

1Open an engagement record for each warehouse export workstream (the weekly open finding snapshot, the daily activity log slice, the weekly exception register export, the monthly dimension refresh, the per-cycle AI report table pull, the warehouse-pipeline incident workstream). Attach the schema contracts, the cadence specifications, the data-classification rules, the on-call rotation, the warehouse loader specification, and the post-incident notes as documents on the engagement record. The pipeline programme reads from one workspace rather than from a Confluence space that ages out before the next surveillance cycle.
2Stand up the export jobs against the existing SecPortal surfaces. The findings view, the activity log feed, the AI report tables, the engagement and client list views, the verified-domain registry, and the exception register read from the API and the in-app export controls under a named service account. The loader on the warehouse side ingests CSV and Excel files into the staging schema before promoting to the published fact and dimension layer.
3Define the schema contract per export class. Document the column set, the data type per column, the redaction rule per column, the cadence, the named owner, and the warehouse loader compatibility check. The schema contract queue holds each export class awaiting a column-change review, the documented contract version, and the scheduled deployment window so column drift fails the contract test rather than silently corrupts the warehouse view.
4Build the warehouse fact and dimension layer against the schema contract. The finding fact joins to the activity log event fact for lifecycle latency, joins to the engagement dimension for cohort definitions, joins to the asset dimension for blast-radius slices, joins to the client dimension for tenant analytics, and joins to the framework crosswalk for compliance attainment reads. The fact table reads against a typed schema rather than against a regex over free-text columns.
5Stand up the BI layer for the audience reads. The CISO and security operations leadership read the warehouse-side leadership dashboard; vulnerability management leadership reads the throughput chart; GRC leadership reads the exception backlog and framework attainment tile; internal audit and external assurance read the multi-cycle assertion tables and pull scoped access on the operational workspace for any sampled finding. The dashboard queries reconcile with the operator queries because they share the same source.
6Operate the pipeline incident queue. When an export run fails, the named on-call data engineer reads the failure (column drift, dimension key gap, service account failure, redaction rule miss), captures the diagnosis on the engagement record, ships the recovery, and updates the schema contract. The post-incident note rides on the activity log so the next reviewer can read the chain without an excavation through chat history.
7Run the data-classification review on a recurring cadence. The classification of finding description text, asset hostname, activity log actor metadata, exception register rationale, and AI report narrative columns gets re-reviewed on the same cycle the security programme reviews access. The decision and the named approver land on the activity log so the next access review or audit can read the chain rather than rebuild it.
8Hand the warehouse-side analytical surface to security analytics and detection engineering. The lifecycle latency, the override frequency, the severity recalibration drift, the SLA attainment, and the cyber risk quantification loss curve all compute from the same finding fact and activity log event fact the security data engineering function loads. The operational workspace remains the source of truth, the warehouse remains the analytical surface, and the security data engineering function owns the contract between them.

Where the security data engineering view connects to the rest of the workspace

Most security data engineering teams adopt SecPortal in three phases: bring the operational finding record, the activity log feed, and the AI report tables onto one documented export surface so the warehouse loader reads a stable schema rather than a rotating spreadsheet; layer in the exception register export, the scan diff feed, and the dimension refreshes so the warehouse fact and dimension layer holds up under the multi-cycle leadership read; then operationalise role-based access, named service accounts, multi-factor authentication, and the data classification cadence so the pipeline meets the access review and audit posture the rest of the organisation operates against. The relevant feature, workflow, and research pages explain each phase in detail.

The full outbound export and warehouse ingest workflow including six export classes, eight failure modes, eight pipeline queues, and the per-audience read pattern lives on the vulnerability finding data export and warehouse ingest workflow. The inbound reverse-ingest path for Nessus, Burp Suite, and generic CSV rides the bulk finding import workflow.
The typed finding record with CVSS 3.1 vector and the open or in_progress or resolved or verified or reopened state lives on the findings management feature page, the append-only event grain on the activity log feature page, and the structured override register on the finding overrides feature page.
The structured CSV and Excel export from the AI report tables lives on the AI reports feature page, the structured intake for Nessus and Burp Suite and CSV on the bulk finding import feature page, and the scan execution diff endpoint on the scan comparison and diff feature page.
The named service account and the role-bound permission model live on the role-based access control feature page, the session AAL promotion on the multi-factor authentication feature page, and the verified-asset registry the warehouse asset dimension reads against on the domain verification feature page.
The cross-engagement cohort patterns the warehouse query pairs against the live record for spot-checks live on the cross-engagement finding search use case, the data quality and completeness sweep that surfaces missing CVSS vectors and missing owners and missing framework mappings on the security finding data quality and completeness workflow, and the leadership cadence the warehouse pack reads against on the security leadership reporting use case.
The deeper analytical reads the warehouse fact tables ground out against sit on the finding record completeness economics research, the vulnerability remediation throughput research, and the vulnerability ingest versus remediation capacity research.
The scanner-side data discipline behind the per-finding fields the warehouse fact table joins against lives on the scanner finding cross-engagement search and recall guide, the per-target collapse on the scanner output deduplication guide, and the change-event source-data on the scanner output diff and change-event generation guide.

Where the security data engineering function hands off to the rest of the security team

The security data engineering function sits at the contract between the operational workspace and the analytical surface. The cohort query against the warehouse sits with the security analyst, the detection content lifecycle sits with detection engineering, the vulnerability backlog sits with vulnerability management, the leadership readout sits with the CISO, the audit-evidence pack sits with GRC and compliance, and the developer platform side of the pipeline sits with platform engineering. SecPortal lets every role read from the same record while running their own workflow against their own surface.

The analyst-side cohort query that the security data engineer ships the dataset to sits on the SecPortal for security data analysts page. The analyst reads the typed schema, the dedup identity, the SLA aging cohort, and the longitudinal queue shape; the engineer ships the contract that makes the read repeatable.
The detection-engineering side that joins the technique-finding cohort to the rule lifecycle and the false-positive register sits on the SecPortal for detection engineering teams page. The rule, the replay, and the post-deployment outcome land on the same engagement record the warehouse loader reads against for the coverage-and-tuning analytics.
The vulnerability backlog, the SLA enforcement, and the prioritisation function the warehouse throughput dashboard reads against live with the SecPortal for vulnerability management teams page. The backlog moves on the operational workspace and the warehouse fact table follows.
The CISO and security operations leadership view that consumes the warehouse-side board briefing and the cyber risk quantification loss curve sits on the SecPortal for CISOs and security leaders page and the operating-cadence companion on the SecPortal for security operations leaders page.
The GRC and audit-evidence side that consumes the per-framework slice and the exception backlog tile off the warehouse sits on the SecPortal for GRC and compliance teams page. The per-framework cohort, the exception register, and the activity log timeline all satisfy multiple audit packs from one record and one warehouse fact join.
The platform-engineering side of the security toolchain (the Git-provider OAuth flow, the credential vault rotation, the scheduled scan cadence, the verified-domain registry the warehouse asset dimension reads against) sits on the SecPortal for platform engineering teams page. The platform team operates the source surfaces; the data engineering team operates the export contract.

Honest scope on what SecPortal does not ship for the warehouse pipeline

Security data engineering teams evaluating SecPortal need an explicit read of what the platform ships and what the platform leaves to the customer-side warehouse stack. SecPortal is the operational record for findings, engagements, scans, exceptions, retests, reports, and the activity log. The warehouse is the analytical surface. The export contract between them runs on documented CSV and Excel pulls the security data engineering function loads on its own pipeline.

SecPortal does not ship a native warehouse connector for Snowflake, BigQuery, Redshift, Databricks, Synapse, Microsoft Fabric, or any other warehouse. The warehouse loader runs on the customer side and ingests the CSV and Excel pulls.
SecPortal does not ship a native source connector for Fivetran, Airbyte, Stitch, Hightouch, Census, or any other ELT or reverse-ELT tool. The export contract is the CSV or Excel pull from the in-app export controls under a named service account.
SecPortal does not ship a native BI connector for Tableau, Looker, Power BI, Metabase, Sigma, or Mode. The dashboard is built on the customer-side BI tool reading the warehouse fact tables the export pipeline loads.
SecPortal does not push directly into Jira, ServiceNow, Slack, Microsoft Teams, PagerDuty, SIEM, SOAR, or any GRC platform. The activity-log slice can be ingested into the warehouse and then routed downstream by the customer-side analytics layer.
SecPortal does not ship enterprise SSO, SCIM, or SAML federation. Workspace authentication uses Supabase Auth with email and password and the workspace-level multi-factor authentication enforcement; named service accounts for the export pipeline are provisioned through the team management workflow inside the workspace.
SecPortal does not auto-generate warehouse DDL, dimension models, or BI dashboards. The schema contract, the warehouse loader, the dimension model, and the dashboard are owned by the security data engineering function on the customer side.

SecPortal is built for security data engineering teams that want a documented export contract against a typed operational record rather than a quarterly CSV pull the analyst rebuilds by hand: a typed finding record with CVSS 3.1 vector and severity band and status state, an append-only activity log with actor and entity grain, structured exception records with the eight-field decision chain, a scan diff endpoint that streams new and fixed and unchanged findings between executions, AI report tables that download as CSV and Excel, bulk finding import for reverse-ingest of Nessus and Burp Suite and CSV, plan-bound retention of 30, 90, or 365 days on the activity log, role-based access control with named service accounts, multi-factor authentication, and a verified domain registry the warehouse asset dimension reads against. The warehouse fact table reconciles with the operational workspace because they share one schema, the boardroom dashboard reads off the same record the operators run on, and the security data engineer ships, versions, classifies, and operates a pipeline that holds up under the next surveillance cycle.

The problems you face

And how SecPortal solves each one.

The leadership dashboard reads from a CSV the security analyst pulled on Tuesday morning, the operator queue reads from the live workspace, and the two numbers drift through the rest of the cycle because no one wrote down the export specification or the cadence

Treat each export as a documented data product with a named owner, a documented landing zone, a schema contract version, a documented cadence, a named service account, and a data-classification rule. The open finding snapshot ships on a weekly cadence and the activity log event slice ships on a daily cadence so the warehouse fact table has the grain the leadership dashboard needs. The boardroom number and the operator queue tell one story because they read from the same record.

Every export job runs under a personal user account the security data engineer set up before the previous quarter, the credential is in a shared password manager nobody rotated, and the access review committee cannot answer who ran what against the workspace last quarter

Run the export pipeline under a named service account provisioned through team management with the viewer or member role the data classification permits. Multi-factor authentication is enforced on every workspace account when the workspace owner requires it. Every workspace event including the export pull, the schema change deployment, the data-classification decision, and the credential rotation lands on the activity log with the actor, the entity, the timestamp, and the action, so the access review reads from one record rather than a spreadsheet reconstruction.

Column drift breaks the warehouse loader silently. The AI report changed a column name three quarters ago and the dashboard has been quoting a stale figure ever since because no one wrote down a schema contract test for the export class

Define the schema contract per export class with the column set, the data type per column, the redaction rule per column, the cadence, the named owner, and the warehouse loader compatibility check. The schema contract queue holds each export class awaiting a column-change review with the documented contract version and the scheduled deployment window. Column drift fails the contract test rather than silently corrupts the warehouse view.

The warehouse pipeline has no event grain because the operational workspace only emits a quarterly CSV of the open queue. The lifecycle latency, the time-in-state decomposition, the override frequency, and the ownership rework analytic all live in the analyst head because the warehouse cannot reconstruct them

The append-only activity log records every finding update, scan run, retest run, exception decision, evidence upload, override change, comment, credential lifecycle event, document upload, and team change with the actor, the entity, the timestamp, and the action. The activity log slice ships as a daily CSV with stable columns the warehouse loads into the event fact table. The 90-day Pro retention covers a quarterly retrospective; the 365-day Team retention covers an annual SOC 2 Type 2 or ISO 27001 surveillance audit window without external archival.

The warehouse has the open finding fact and the lifecycle event fact, but the dashboard joins to a free-text hostname column that drifts and the asset dimension never reconciles with the operational view because no canonical asset reference travels on the export

The verified-domain registry holds the per-asset records the warehouse asset dimension reads against. Domain verification through DNS TXT, HTML meta tag, or .well-known file is the precondition the operational workspace enforces. The warehouse joins the finding fact to the verified-domain record by the canonical asset reference rather than by a free-text hostname column, so the asset dimension reconciles with the operational view.

The exception backlog tile on the GRC dashboard reads from a parallel spreadsheet because the operational exception register lives in a narrative document the warehouse cannot parse, and the eight-field decision chain the auditor expects shows up as a paragraph rather than as columns

Exceptions are captured on the same engagement as the finding they cover with linked finding, severity, compensating controls, residual likelihood, residual impact, business rationale, named approver, expiry date, and review cadence. The exception register exports as a queryable cohort with the eight-field decision chain as stable columns. The warehouse GRC tile reads the same record the operational workspace records rather than a narrative reconstruction.

Sensitive columns leak into the wrong warehouse environment because no one captured a per-column data-classification decision on the export job. The finding description with raw exploit payload landed in the analytics warehouse the BI tool reads against unredacted

Classify every export column as raw, redacted, hashed, or omitted before the loader touches the warehouse. The finding description, the asset hostname, the activity log actor metadata, the exception register rationale, and the AI report narrative columns all carry per-column classification rules. Capture the decision on the export job specification and on the activity log entry the pipeline writes back into the workspace so the chain is reconstructable when the access review asks how a restricted column got into the warehouse.

Reverse-ingest into the operational workspace runs through a backdoor connector that bypasses the audit trail. The warehouse-derived dataset goes back into the source record without a documented intake, and the next surveillance audit cannot reconstruct what changed

Bulk finding import accepts Nessus, Burp Suite, and generic CSV through a documented intake. Scanners and warehouse-derived datasets that need to land in the operational workspace ride the import workflow with the source identity on every imported row. The operational workspace remains authoritative for the current state and the audit trail captures the intake on the activity log.

The AI report tables that the leadership pack reads against live in a PDF the security analyst hand-copies into the deck every quarter. The warehouse fact table for the leadership pack cannot ride the same source as the operator queue because the report output is unstructured

The AI report chat surfaces structured tables that download as CSV and Excel directly from the report view for severity distribution, remediation throughput, exception register, framework coverage attestation, and the per-engagement narrative tables. The warehouse fact table for the leadership pack ships from the same record the operational analyst already reads against, so the boardroom dashboard and the operator queue tell one story.

The pipeline incident queue lives in the on-call data engineer head. When an export fails, the diagnosis happens in chat, the recovery happens in a notebook, the schema contract update happens in a Confluence page that ages out, and the next on-call engineer reconstructs the chain from scratch

Open an engagement record for the warehouse pipeline workstream and attach the schema contracts, the cadence specifications, the data-classification rules, the on-call rotation, the warehouse loader specification, and the post-incident notes as documents on the engagement record. Every workspace event the pipeline triggers lands on the activity log so the post-incident note reads against a defensible chain rather than a recovered chat thread.

Key features for you

Vulnerability management software that tracks every finding

Every action recorded across the workspace

AI-powered reports in seconds, not days

Finding overrides that survive every scan cycle

Bulk finding import bring your scanner data with you

Scan-to-scan diff see what changed between any two executions

Role-based access control with least privilege by default

Multi-factor authentication on every workspace

Verify ownership before any scan runs

Collaborate across your entire team

Compliance tracking without a full GRC platform

Monitor continuously catch regressions early

Ship the warehouse pipeline against a typed operational record

A typed findings record with CVSS 3.1 vector and severity band and status state, an append-only activity log with actor and entity grain, structured exception records with the eight-field decision chain, scan execution records with a structured diff endpoint, AI report tables that download as CSV and Excel, bulk finding import for reverse-ingest of Nessus and Burp Suite and CSV, plan-driven CSV export, role-based access control with named service accounts, multi-factor authentication, and a verified domain registry on one workspace. Free plan available.