What your scanner can't see: Deep visibility into hardened container images with Black Duck

Why hardened images trip up traditional scanners

Standard container scanning tools typically rely on package manager manifests to inventory what's inside an image. That works fine for most images. But hardened containers are specifically designed to strip out package managers, shells, and anything else that isn't strictly necessary, including a lot of the metadata those scanners depend on.

The result? Traditional tools either miss components entirely or produce reports so inaccurate they're more hindrance than help.

A "better together" strategy for container security

Black Duck's approach to hardened image scanning is built on two complementary analysis technologies working together for full coverage across your container stack.

• Black Duck Binary Analysis (BDBA): Preforms signature-based inspection of compiled componensts within hardened images, identifying dependancies without requiring access to source code.
• Black Duck SCA: The forthcoming release will include hardened image identification and verification support, unifying image intelligence with source-side dependency management. This will enable you to generate more comprehensive SBOMs by combining image and source level dependency insights across the SDLC.

Here’s a quick overview of the capabilities.

• Zero-config recognition: In most cases, Black Duck SCA can identify hardened base images during scanning without requiing manual tagging.
• Precision triage: Publisher-provided VEX data plus Black Duck Security Advisories (BDSAs) help reduce noise and triage effort.
• Comprehensive vulnerability intelligence: Image publisher exploitability data combined with Black Duck's proprietary research helps to reduce false positivies.
• Compliance without the scramble: Black Duck SCA helps generate SBOMs enriched with VEX exploitability status, supporting obligations under the Cyber Resilience Act and FDA medical device standards.

Hardened image insights are being integrated into Black Duck SCA to support more consistent policy and governance across container and source code analysis.

Cutting through alert noise with VEX and BDSAs

Accurate identification is step one. Step two is making sure your team isn't spending their days triaging alerts, or worse, pointing fingers at each other over who owns them. Two data sources help streamline this process.

• VEX Integration: Black Duck SCA ingests VEX statements from image publishers. When a vulnerabilities is marked as not affected, this context can be used to suppress of reprioritize alerst, helping reduce unnecessary triage. These signals can be incorperated into policy workflows to guide remediation decisions.
• Black Duck Security Advisories: While many tools rely solely on National Vulnerability Database (NVD) data, Black Duck SCA pairs VEX data with its own proprietary BDSAs. These advisories provide deeper exploitability context, more precise version-level mapping, and remediation guidance. In Q1 2025, BDSAs were issued an average of 165 days faster than NVD-analyzed CVEs. For high and critical vulnerabilities, that gap was 203 days. When timing matters on a true critical CVE, that lead time is significant.

Keeping the pipeline moving

• Black Duck manages the full life cycle through a comination of analysis tools and pipeline integrations.
• SLA tracking: Easily integrate with tools like Jira or email systems to trigger alerts or tickets when a vulnerability in a custom layer exceeds your organization's risk threshold, ensuring nothing slips through without someone owning it.
• Pipeline gating: Use the Black Duck Detect CLI to fail builds based on policy-defined risk thresholds allowing theCI/CD pipeline to keep moving for everything else.
• Continuous patching: Help verify when updated base images are scanned and evaluated, supporting validation of remediation efforts  to your private repository, so you can confirm mitigation without requiring a developer to manually rescan to prove compliance.