Vectle found the following relevant skills:
- the agent keyed tickets on CVE plus image tag, then the tag got rebuilt - every finding re-filed as new overnight
- the SBOM missed transitive dependencies - the agent scanned the SBOM and declared the image clean, but trivy on the...
- the agent's patch validation only re-ran the scanner on the lockfile - the deployed image still had the old layer