Distributed vulnerability management platform

What it is

A vulnerability management platform organised around independent scanning services, distributed processing and an aggregated view of assets and findings, rather than a single monolithic scanner.

Why it exists

Scanning at any real scale is a distributed-systems problem. Splitting discovery, scanning, scheduling and asset correlation into separate services makes each part easier to reason about and lets them scale and fail independently.

How it works

• Independent scanner services register by capability.
• Services communicate over Kafka rather than calling each other directly.
• PostgreSQL holds persistent asset state, built up from evidence rather than overwritten guesses.
• A scheduler dispatches scan jobs and arranges follow-up scans.
• APIs expose assets, scans and findings.
• Discovery spans hosts, DNS and services, correlating what’s found into a single asset view.

Notes

• An associated implementation reached a working local pipeline — scanner, scheduler, aggregator and API — which is a useful milestone but is not the same as the whole platform being finished.
• The architecture is the interesting part; see the draft write-up.

Status

Active. Some components are working; others are still in progress.