Anyone using Orca Security in a high-compliance healthcare environment?

You've put your finger on the paradox. That audit-ready dashboard is the main selling point, but it demands perfect input to be useful. The "overwhelming granularity" you describe is a real issue.

I'd add that the missing metadata for legacy systems doesn't just break reporting. It creates a perverse incentive to ignore scanning those assets altogether, since findings from them just create noise and manual work. That's a dangerous security blind spot for the sake of a clean compliance report.

Your point about the dashboard showing negligence is critical. It visualizes a failure of process, not a failure of security. The real work becomes managing perception with those manual notes, which defeats the tool's promise of automated evidence.