Container Adoption Comes with Risks for Software Supply Chain

Multiple critical vulnerabilities and risks have been found lurking within some of the most commonly downloaded Docker Hub container images.

The NetRise study examined 70 randomly selected images from the top 250 downloads, uncovering an average of 604 known vulnerabilities per container, with more than 45% dating back 2 to 10+ years.

Step 1 of 7

14%

Which of the following best describes how you currently monitor and manage systems across your hybrid cloud environment?(Required)

Multiple separate tools for different environments

Multiple separate tools for different monitoring and management functions

Single consolidated dashboard

Custom built monitoring and management solution

No full monitoring and management solution

Don’t know

How valuable would it be for your monitoring and management solution to incorporate predictive analytics to help you identify and address system issues that are critical and not waste time or effort working through all the data and “noise” that is not critical?(Required)

Extremely valuable

Moderately valuable

Somewhat valuable

Slightly valuable

Not valuable

How do you most typically address potential system issues BEFORE they impact your operations?(Required)

Automated workflows and playbooks to remediate potential issues as soon as they are detected

An orchestrated response process that leverages automation, AI, and human expertise to rapidly respond to potential issues

Advanced monitoring tools such as predictive analytics and anomaly detection to proactively identify and address potential issues

Respond to issues as they arise, using manual processes and troubleshooting techniques

A combination of automated remediation, orchestrated response, and/or proactive monitoring to address potential system issues

Don’t know

Other

What methods does your organization use to control and monitor cloud/IT spending?(Required)

Centralized procurement processes

Pre-approved budget thresholds

Automated cost monitoring tools

Department-level spending controls

Regular cost audits and reviews

Cloud cost optimization platform

Approval workflows for resource provisioning

Native financial operations tools provided by the cloud provider

No formal controls in place

Don’t know

Other

Please specify:

Which methods do you rely on most to detect security vulnerabilities in your systems?(Required)

Automated scanning tools

Manual assessments

Vendor notifications

Threat modeling (for early detection)

None of these

Don’t know

Other

Please specify:

What are the TWO most common ways you prioritize vulnerabilities to address within your environment?(Required)

Based on potential impact

Based on exploitability

Regulatory compliance requirements

Based on CVSS scores

Risk-based analysis of multiple factors

First-in-first-out approach

No formal prioritization process

Don’t know

How do you typically handle system updates and security patches?(Required)

Automated updates and patches

Manually review and apply updates and patches on a regular schedule

A combination of automation and manual review

Apply updates and patches on an as-needed basis.

Outsourced update and patch management

No defined process

Don’t know

Other

Δ

The report found that 4% of these vulnerabilities are weaponized, and actively exploited by botnets and threat actors.

Adding to the challenges, one in eight container components lacked a software manifest, leaving crucial metadata about dependencies and sources missing, further complicating security efforts.

Misconfigurations were another widespread issue, with containers averaging nearly five per image, including overly permissive identity controls and insecure directories.

The findings from the study indicate the critical importance of having a detailed understanding of all software components and risks.

Michael Scott, chief technology officer and co-founder of NetRise, explained organizations must prioritize integrating software analysis into their cybersecurity processes and workflows.

“Organizations can address visibility gaps in containerized software by adopting advanced analysis tools that go beyond traditional scanning methods,” he said.

These tools analyze compiled and interpreted code, giving them visibility into the software, even for containerized software lacking formal manifests.

He said container security remains a weak link in the software supply chain because of the inherent complexities and lack of visibility into the containerized software.

Additionally, the rapid adoption of containerized applications has outpaced the development of security processes and tools, leaving gaps in risk identification and mitigation.

“Addressing these challenges requires a move to advanced visibility platforms and a focus on proactive risk-based management throughout the software lifecycle,” he noted.

Strengthening Software Supply Chains

Scott said organizations aiming to strengthen their software supply chain security should take several foundational steps.

First, generating comprehensive Software Bill of Materials (SBOMs) is essential to understanding detailed software components, which serve as the basis for effective security measures.

An SBOM is designed to provide complete transparency into the components that make up the analyzed software including containerized applications.

Scott noted software transparency can and should go well beyond the SBOM, with software security intelligence also including enrichment data around software risks like vulnerabilities, non-CVE risks, exploitability, reachability and emerging threats and life-cycle management items like licensing, provenance and end-of-life.

“Automated software risk analysis should also be implemented to uncover a complete risk profile for each software or firmware package,” he added.

Beyond traditional CVSS scores, organizations should prioritize and compare software risks by considering additional factors such as weaponization and network accessibility.

Finally, Scott said establishing responsible vulnerability and risk disclosure practices with software vendors is critical for improving the overall state of software security for all stakeholders involved.

“Enterprises should prioritize vulnerabilities based on a risk-based approach that considers factors such as CVSS scores, weaponization status and exploitability,” he said.

For example, identifying vulnerabilities actively exploited by threat actors or listed in catalogs like CISA’s Known Exploited Vulnerabilities (KEV) helps focus resources on the most critical threats.

Improving Ownership, Accountability

Scot said organizations can improve ownership and accountability for container security by building security practices across the software lifecycle and defining roles and responsibilities.

“Development teams should consider security from the start, using tools to generate SBOMs and assess risks during the build phase,” he said.

He added ops teams must ensure secure configurations, regular updates and compliance checks in deployment and runtime environments.

“Assigning clear ownership for each phase helps ensure container security is a shared responsibility, not an afterthought,” he said.