ScanRook Blog

Educational articles on vulnerability scanning, CVE databases, exploit prediction, and container security.

Best practices

How to Scan a Docker Image for Vulnerabilities (4 Ways)

A step-by-step guide to scanning Docker images for vulnerabilities with Docker Scout, Trivy, Grype, and ScanRook — how to export an image, read the results, fix findings, and automate scanning in CI/CD.

Integrations

ScanRook MCP Server: Let AI Assistants Scan for Vulnerabilities

Introducing the ScanRook MCP server — give Claude, GPT, and any MCP-compatible AI assistant the ability to scan container images, check CVEs, and analyze licenses through natural conversation.

Benchmarks

Vulnerability Scanner Benchmark 2026: ScanRook vs Trivy vs Grype vs Snyk

Comprehensive 2026 vulnerability scanner benchmark comparing ScanRook, Trivy, Grype, and Snyk on real container images. Methodology, timing data, finding counts, and accuracy analysis.

Data sources

CVE Database Comparison: NVD vs OSV vs GHSA vs Snyk Intel (2026)

Comprehensive comparison of vulnerability databases — NVD, OSV, GHSA, Snyk Intel, and Red Hat OVAL — covering coverage, update speed, API access, and when to use each.

Benchmarks

ScanRook Benchmark Results: Real Scan Data Against Trivy and Grype

Transparent benchmark results comparing ScanRook, Trivy, and Grype on five container images with analysis of finding differences.

Launch

Why We Built ScanRook

Why we chose a local-first scanner architecture with optional cloud enrichment.

Technical deep-dive

What Is an SBOM? How ScanRook Uses SBOMs for Faster, More Accurate Triage

A practical guide to SBOMs, why they matter for security programs, and how ScanRook uses them in real workflows.

Security Concepts

What Is a CVE? A Plain-English Guide to Vulnerability IDs

What a CVE is, what the ID format means, who assigns them, and how the CVE lifecycle works — plus how CVE relates to CVSS, CWE, EPSS, and KEV.

CVE Deep Dive

Log4Shell (CVE-2021-44228) Explained: Detection and Remediation

A clear technical explanation of Log4Shell (CVE-2021-44228), the critical Log4j RCE — how the JNDI exploit worked, affected versions, the follow-up CVEs, and how to detect and remediate vulnerable JARs.

Best practices

Alpine vs Debian vs Distroless: Which Container Base Image Is Most Secure?

Comprehensive comparison of Alpine, Debian Slim, Ubuntu, and Distroless container base images for security. Real vulnerability scan data, size comparison, compatibility tradeoffs, and migration guide.

Prioritization

EPSS Scores: How to Prioritize Vulnerabilities by Exploit Probability

A practical guide to using EPSS for vulnerability prioritization. Decision matrix, real CVE examples, CVSS comparison, and integration with ScanRook.

CVE Deep Dive

regreSSHion (CVE-2024-6387): The OpenSSH Vulnerability That Exposed Millions of Servers

Deep dive into regreSSHion (CVE-2024-6387), the OpenSSH signal handler race condition that affected 14 million internet-facing servers. Technical analysis, detection, and remediation.

Best practices

Container Image Security Checklist: 15 Steps for Production-Ready Images

A comprehensive 15-step security checklist for hardening container images before production deployment, covering base images, scanning, secrets, runtime security, and monitoring.

Technical deep-dive

How to Read an SBOM: CycloneDX vs SPDX Explained with Real Examples

Learn how to read and interpret Software Bill of Materials in CycloneDX and SPDX formats with annotated real-world examples, comparison tables, and regulatory context.

Data sources

What Is the OSV API? Ecosystems, Advisories, and How It Works

A practical guide to the Open Source Vulnerabilities database, the advisory format it uses, and how scanners query it for vulnerability data.

Data sources

Understanding the NVD and CVSS v3.1 Scoring

How the National Vulnerability Database works, what CPE matching means, and how CVSS v3.1 base scores are calculated.

Prioritization

EPSS Scores Explained: Exploit Prediction for Vulnerability Prioritization

What EPSS is, how percentile scores work, and why exploit probability is a better prioritization signal than severity alone.

Prioritization

CISA KEV Guide: Why Actively Exploited CVEs Demand Immediate Action

What the CISA Known Exploited Vulnerabilities catalog is, who it applies to, and how to use it in your remediation workflow.

Scanning concepts

Installed-State Scanning vs. Advisory Matching: Reducing False Positives

Why reading actual package manager databases produces more accurate findings than matching file paths against advisory lists.

Best practices

Container Scanning Best Practices for Security Teams

Practical guidance on scanning container images effectively, from base image selection to CI/CD integration and finding prioritization.

Deep scanning

What Is YARA and Why Security Teams Use It

A guide to YARA, the pattern-matching engine used by security teams for malware detection, and how ScanRook integrates it for deep container scanning.

Compliance

Vulnerability Scanning for Compliance: What You Need to Know

Penalties for non-compliance, scanning frequency requirements by framework, and how to build a compliant vulnerability scanning program.

License Compliance

What We Learned from Black Duck (And How We Made License Scanning Better)

How Black Duck pioneered license scanning with snippet matching and proprietary databases, what has changed since 2005, and how modern tools deliver the same results at a fraction of the cost.

License Compliance

The Complete Guide to Open Source License Compliance in 2026

A comprehensive guide to open source license compliance covering legal risks, common mistakes, building a compliance program, tooling comparisons, and SBOM integration.

Architecture

On-Prem vs SaaS Vulnerability Scanning: Which Is Right for You?

Data sovereignty, air-gapped environments, cost comparison, and when on-prem scanning is required versus when SaaS makes sense.

Security Concepts

How Red Hat Backports Security Patches: A Complete Guide to RHEL Vulnerability Management

Understand how Red Hat backports security fixes, why package versions don't tell the full story, and how OVAL/CSAF data enables accurate RHEL vulnerability scanning.

Security Concepts

Is the Nginx Docker Image Safe? What Our Scanner Found

We scanned nginx:1.27 with ScanRook: 2,952 findings (408 critical). What that means, which CVEs matter, and why the Alpine tag cuts findings by 79%.

Best practices

How to Reduce CVEs in Docker Images: 6 Steps That Work

Six concrete steps to reduce CVEs in Docker images: smaller base images, multi-stage builds, package updates, rebuild cadence, and scan verification.

Integrations

How to Scan Docker Images in GitHub Actions

A complete GitHub Actions workflow for scanning Docker images: install the scanner, scan on pull request, upload reports, and fail builds on critical CVEs.

Benchmarks

Trivy Alternatives in 2026: When to Use Something Else

An honest look at Trivy alternatives — ScanRook, Grype, Snyk, Docker Scout — with benchmark data on finding depth, speed, and if Trivy is still right.

Security Concepts

Is the Postgres Docker Image Safe? What Our Scanner Found

We scanned postgres:17 with ScanRook: 2,983 findings (387 critical). What that means, which CVEs matter, and why the Alpine tag cuts findings by 86%.

Security Concepts

Is the Redis Docker Image Safe? What Our Scanner Found

We scanned redis:7-alpine with ScanRook: 299 findings (20 critical) versus 1,399 (114 critical) for the Debian-based redis:7 tag. Which tag actually wins.

Best practices

How to Patch Docker Base Image Vulnerabilities

A step-by-step guide to patching Docker base image vulnerabilities: retag, rebuild with --pull, apply OS patches, pin digests, and verify with a scan.

Security Concepts

Is the Node Docker Image Safe? What Our Scanner Found

We scanned node:22 with ScanRook: 30,726 findings (1,794 critical). What that means, which CVEs matter, and why node:22-alpine cuts findings by 99%.

Security Concepts

Is the Python Docker Image Safe? What Our Scanner Found

We scanned python:3.12 with ScanRook: 31,590 findings (1,875 critical). What that means, which CVEs matter, and why the Alpine tag cuts findings by 99%.

Best practices

Multi-Stage Docker Builds for Security: A Practical Guide

How multi-stage Docker builds improve security: split build and runtime stages, avoid leaking build secrets, and ship a minimal final image.

Integrations

How to Scan Docker Images in GitLab CI

A complete GitLab CI pipeline for scanning Docker images: build in Docker-in-Docker, scan with ScanRook, store reports, and fail merge requests on critical CVEs

Best practices

Migrating to Distroless Images: A Step-by-Step Guide

How to migrate Docker images to distroless: assess your base, adapt the build per language, handle debugging without a shell, and verify with a scan.

Benchmarks

Grype Alternatives in 2026: When to Use Something Else

An honest look at Grype alternatives — ScanRook, Trivy, Snyk, Docker Scout — with benchmark data on finding depth, SBOM workflows, and when Grype is right.

Integrations

Jenkins Docker Image Scanning: A Complete Pipeline

A complete Jenkins pipeline for scanning Docker images: build, save, scan with ScanRook, archive the report, and fail the build on critical or high CVEs.

Best practices

Docker Image Hardening Checklist: 8 Steps With Code

An eight-step Docker image hardening checklist with runnable code for each step: non-root users, minimal base images, capability drops, and scanning.

Best practices

How to Automate Docker Base Image Updates

How to automate Docker base image updates with Renovate or Dependabot, scheduled CI rebuilds, digest pinning, and automatic scan verification.

Best practices

How to Fix npm Vulnerabilities in Docker Builds

How to fix npm vulnerabilities in Docker builds: audit and patch the lockfile, use npm ci, exclude devDependencies, and verify with a rescan.

Benchmarks

Snyk vs Trivy vs Grype: Which Should You Actually Use?

Snyk vs Trivy vs Grype compared honestly: pricing, workflow, and finding depth, with benchmark data on where open source diverges from commercial scanners.

Best practices

The Minimal Docker Image Guide: Alpine, Distroless, Scratch

A practical guide to building minimal Docker images: choosing a base tier, static binaries into scratch, multi-stage cleanup, and size verification.

Best practices

How to Triage Vulnerability Scan Results

A repeatable vulnerability triage process: rank findings by severity, EPSS, KEV, and reachability, gate CI, assign owners, and re-scan on a cadence.

Compliance

SBOM Requirements in 2026: A Practical Map

A practical map of SBOM requirements in 2026: federal procurement, the EU Cyber Resilience Act, FDA medical device rules, and what teams need in place now.

Benchmarks

OSV vs NVD: How the Two Vulnerability Databases Actually Differ

OSV vs NVD compared: how each publishes and matches vulnerability data, where their coverage diverges, and why scanners that use only one develop blind spots.

Integrations

Kubernetes Admission Control for Image Scanning

How Kubernetes admission control blocks unscanned or vulnerable container images at deploy time, with a working Kyverno policy and where ScanRook fits the gate.

Compliance

The EU Cyber Resilience Act and Container Images

What the EU Cyber Resilience Act means for container images: SBOM duties, vulnerability handling, and patching obligations for products with digital elements.

Security Concepts

What Is a Vulnerability? Weaknesses, CVEs, and Risk

What a vulnerability is in security terms: how it differs from threats and risk, common types, the CVE lifecycle, and how scanners find known weaknesses.

Best practices

Vulnerability Management: A Practical Lifecycle Guide

Vulnerability management is a continuous lifecycle, not a one-time scan. The stages, risk-based prioritization, SLAs, metrics, and where ScanRook fits.

Scanning concepts

What Is SCA? Software Composition Analysis Explained

What SCA (software composition analysis) is: how it inventories open-source components, matches them to known CVEs and licenses, and where it fits vs SAST.

Scanning concepts

Gitleaks: Fast Secret Scanning for Git Repos and CI

Gitleaks is a fast, open-source secret scanner for git repos and CI. How its regex and entropy detection works, its tradeoffs, and where ScanRook fits.

Best practices

Ubuntu vs Debian: Which Docker Base Image to Choose

Ubuntu vs Debian as a Docker base image: real security, size, and support tradeoffs, plus a clear recommendation for most container workloads.

Security Concepts

SAST vs DAST: How Application Security Testing Differs

SAST vs DAST explained: how static and dynamic application security testing differ, what each catches and misses, and where SCA and IAST fit alongside them.

Benchmarks

Anchore Alternatives in 2026: A Fair Comparison

An honest look at Anchore alternatives — Grype, Syft, Trivy, Snyk, and ScanRook — covering the open-source tools, Anchore Enterprise, and when each wins.

Best practices

Patch Management: A Practical Guide for Modern Stacks

Patch management is how you close known vulnerabilities. The lifecycle, prioritization, testing, and why containers are rebuilt instead of patched.

CVE Deep Dive

Heartbleed (CVE-2014-0160) Explained: Impact and Remediation

Heartbleed (CVE-2014-0160) leaked server memory through an OpenSSL TLS heartbeat over-read. Affected versions, the private-key risk, and how to remediate it.

Best practices

Kubernetes Secrets Security: A Practical Guide

A practical guide to Kubernetes secrets security: why base64 is not encryption, encryption at rest, RBAC, external secret stores, and safe mounting.

Best practices

Docker Security: A Practical Hardening Guide for 2026

A practical Docker security guide: harden containers with non-root users, dropped capabilities, read-only filesystems, seccomp, and image scanning.

Best practices

Docker Rootless Mode: How and Why to Run Without Root

Docker rootless mode runs the daemon as a non-root user so a container escape lands unprivileged. How it works, how to set it up, and its limits.

Data sources

NVD API Key: How to Get One and Why Scanners Need It

How to request and use an NVD API key: the rate limits with and without one, how to send it, and why vulnerability scanners need it for enrichment.

Scanning concepts

kube-bench: Scanning Kubernetes Against the CIS Benchmark

kube-bench checks whether your Kubernetes cluster is configured to the CIS Benchmark. How it works, how to run it, what it catches, and what it does not.

Scanning concepts

Secret Scanning: A Practical Guide to Finding Leaked Keys

Secret scanning finds hardcoded credentials in code, git history, and images. Detection methods, the tool landscape, remediation, and where ScanRook fits.

Integrations

Trivy Operator: Continuous Scanning Inside Kubernetes

The Trivy Operator continuously scans Kubernetes workloads and writes vulnerability, config, and secret reports as CRDs. How to install and use it.

CVE Deep Dive

Leaky Vessels (CVE-2024-21626): runc Container Escape

Leaky Vessels (CVE-2024-21626) is a runc container escape via a leaked file descriptor. How it works, the affected versions, the 1.1.12 fix, and detection.

Best practices

Pod Security Standards: A Practical Kubernetes Guide

A practical guide to Kubernetes Pod Security Standards: the Privileged, Baseline, and Restricted profiles, Pod Security Admission, and enforcement.

Benchmarks

Trivy vs Grype: An Honest Comparison of Two Scanners

Trivy vs Grype compared honestly: scope, databases, output formats, speed, and finding depth, with benchmark data and when to pick each scanner.