This article summarizes a
recent SC webcast with host Adrian Sanabria, Patrick Maddox, VP of Solutions Architecture at Minimus, and Neil Carpenter, Field CTO at Minimus. They discussed why traditional “scan and prioritize” models no longer cut it, and what it takes to shift toward true risk reduction.
The evolving challenge of vulnerability management in containers
As organizations increasingly adopt containerized environments, security teams are grappling with a surge in software vulnerabilities. During the webcast, the experts from Minimus described how the number of reported CVEs (Common Vulnerabilities and Exposures) has ballooned, fueled by both the proliferation of software and the rise of automated vulnerability discovery tools.
“Everything is now software,” Carpenter said, pointing to the growing complexity of modern infrastructure. The panelists highlighted that many organizations struggle to keep up, with security teams often overwhelmed by lengthy lists of vulnerabilities—most of which pose little real risk.
Developers, meanwhile, are frustrated by demands to patch issues that may not even affect their applications. The friction is compounded in containerized environments, where remediation often requires rebuilding and redeploying images, rather than simply patching a running system.
Industry turns to streamlined approaches amid complexity
In response to these challenges, panelists said the industry is shifting toward more targeted and efficient vulnerability management strategies.
Prioritization frameworks, such as CVSS and EPSS, are being used to help teams focus on the vulnerabilities most likely to be exploited.
Another trend is the adoption of minimal container images, which reduce the attack surface by including only essential components. This approach, discussed during the webcast, aims to cut down on unnecessary vulnerabilities and streamline the patching process.
While companies like Minimus are developing solutions in this space, the broader message from the panel was clear: reducing complexity and noise is key to making vulnerability management more effective.
As organizations continue to navigate an ever-changing threat landscape, the panelists agreed that collaboration between security and development teams—and a focus on actionable intelligence—will be critical for real risk reduction.
