An audit finds that container images in the company's registry include operating system packages and libraries with published CVEs, and some of those images are already running in production. Which control addresses the source of this problem?

Container image vulnerability scanning inspects the operating system packages and application libraries inside each image layer and compares their versions against published vulnerability data. Integrating scanning into the CI pipeline and the registry lets teams fail builds or block deployments when images exceed a severity policy, and lets them rebuild affected images from patched base images. Because the audit finding is that images contain known vulnerable components, scanning and remediation at build and registry time address the source, and rescanning registry images also identifies which running workloads need replacement. An egress rule limits what a compromised container can reach, which is a sensible compensating control, but the vulnerable packages remain and can still be exploited by inbound traffic. Runtime detection catches suspicious behavior after an attacker is already active; it is complementary defense, not a fix for known vulnerable software. Rotating registry credentials restricts who can push images, which helps supply-chain integrity, but the CI system can still push images that contain vulnerable packages. Exam caveat: scanning finds known vulnerabilities only; it does not detect zero-days, which is why runtime protection still matters. Operational check: run the scanner against the registry, list running workloads that use images with critical findings, and confirm the pipeline now fails builds above the agreed severity threshold.