How Postman's security team turned scattered logs into answers in seconds

Defending Postman is different from defending most companies: Postman is where the APIs are. With the rise of agentic AI, APIs have become one of the most valuable surfaces a company has. Postman's security operations team protects the APIs and data across its 50M+ developers, while keeping it agent enabled, agent defended, and open to the innovation of its users.

Before Scanner, the team's logs were spread across many systems. Answering a simple question during an investigation meant starting in one tool, logging in to another, and then asking someone to grant access to a third. Every hop, and every wait on an access request, added time to the investigation.

Postman centralized its security logs in Scanner, bringing far more sources into one place than before. With everything in a single system, the team correlates across sources and pulls the full picture together in one search. Fast indexing means confirming whether a specific user logged in somewhere takes about as long as asking the question.

When Vivienne Pustell joined Postman to lead security operations, Scanner was already in place. During her first investigation, her query came back practically as fast as she hit enter, and her immediate reaction was that it was incredible. The UI is designed with engineers in mind: every attribute on the screen has a purpose, and the query language is straightforward enough that new team members can walk in and start asking questions right away. A Terraform template makes adding sources simple: an engineer copies the file, edits it, pushes it, gets approval from a colleague, and new logs start flowing in.

Centralizing logs in Scanner gave Postman's security team faster answers and a platform its engineers want to use:

• Centralized visibility: logs that once lived across many systems now sit in one place, ready to correlate.
• Near instant answers: queries return practically as fast as the analyst hits enter.
• Faster iteration: speed lets analysts refine questions repeatedly until they narrow in on the answer.
• Intuitive for engineers: a UI where every attribute has a purpose and a straightforward query language mean new users get productive immediately.
• Log onboarding as code: a Terraform template turns adding a new source into a simple file change and peer review.

Speed changed how Postman's team investigates. Analysts now ask a question, get an answer, and refine it in seconds. As more log sources moved into Scanner, the platform grew more valuable with each one, creating a compounding effect across the security program. Easy onboarding has also made it easier for the team to test and experiment with new detections. Engineers have a place to explore, which leads to stronger detections and a stronger security program overall.

For Vivienne, the lesson is simple: it's all about the logs. Every alert, every investigation, every incident response, and every cleanup after the fact comes down to whether the team has the logs to do it. Her advice to security leaders is to ingest everything they can and centralize it, so they can connect it all together easily.