Solution #1: Let's build a reporting tool
The team charged ahead and started building an automated reporting tool. At first, it was all going so smoothly!
I said, "This can't be that hard," and sure enough, there's a Python library. With a bit of Jinja and some terrible code, you can get halfway there. You can take a Qualys Scanner, a Nessus Scanner, whatever, and dump all the findings onto a report.
Remember, they didn't want to just dump scanner data into a Word document, they wanted to make sure that they could report in a meaningful way. That meant replacing default descriptions with their own descriptions, displaying Evidence for hosts in an easy-to-understand way, and more.
So, at this point, they had all the tool output in the Word document. Halfway there, right?
Then, you reach the other half which is actually like, 90% of the work where it's like:
"Okay, how do I nicely display evidence for all my hosts"
"How do I do a custom finding description lookup?"
You're going down this rabbit hole and at some point, I'm like, "Well, how long is this going to take?"
It's fun to do this, but what do I want to be spending my time doing?
What does [Company] want me spending my time doing? Do they want to fund my development of this tool or do they want me to be testing and making them money? It's a fairly obvious answer there.