Fewer Vulnerabilities from the Start: Hardened Container Images

What if, instead of fixing hundreds of vulnerabilities in container images, we could reduce them at their origin?

A significant portion of the vulnerabilities we identify in container images do not originate from code developed by the organization. They come pre-packaged with the base image itself.

The operating system, libraries, and packages upon which an application is built can introduce dozens or even hundreds of CVEs — long before the first line of application code is written. This often leads to a familiar cycle:

Scanning identifies vulnerabilities → Security team contacts development → The image is updated → A new version is built → And new vulnerabilities are discovered.

A Different Approach with WizOS

WizOS offers a different approach: starting with secure and minimal base images and application images. These images are built and continuously maintained with the goal of keeping the number of CVEs close to zero.

These images include, among other features:

• Only essential components and libraries to minimize the attack surface.
• A number of CVEs close to zero, subject to a hardware-based SLA.
• A signed Software Bill of Materials (SBOM), providing full visibility into the components included in the image.
• Cryptographic signatures that allow verification of the image's origin and integrity.
• Continuous scanning and rebuilding, with updates as frequent as daily.

Shifting Left on Container Security

This doesn't mean you stop scanning images or managing vulnerabilities. It means addressing risk earlier — at the point where dozens of applications might inherit the same vulnerabilities.

Sometimes, the best way to reduce the number of alerts isn't to improve the remediation process. It's to build from the outset on an infrastructure that inherently generates fewer of them.