First, let's see how a typical container vulnerability scan works.

• Vulnerability scanner enumerates all the installed packages and their versions on your container
• For each installed package, it queries a Vulnerability DB to check if that package has a vulnerability. You can think of the Vulnerability DB containing tuples like:
  (Package Name, Package Version, Vulnerability)
• This creates a lot of noise because the scanner doesn't actually know how that package is used. It will report a vulnerability simply by seeing the presence of that Package.
• It also reports certain "vulnerabilities" that have no impact.

We noticed that due to the security features of containers, the majority of vulnerabilities are simply not exploitable. Using smart rules, we filter out these kinds of vulnerabilities.

We also maintain a database of vulnerabilities that are conditionally false positives. Thus, leveraging the context of how the container is used to filter out false positives.