Evaluate container scanners on your own images, not samples. Check coverage of operating system and language packages, attribution of findings to layers, handling of distroless or minimal bases, registry and CI integration, speed, and the quality of any SBOM the scanner exports.
Pick awkward images
Choose a typical service image, an image with a minimal or distroless base, one with compiled binaries, and the largest image you run. Scanners differ most on the awkward ones. Run each tool on the same image digests so comparisons are fair.
What to check
Does it find OS packages and language packages in the same pass? Does it show which layer introduced a package, so teams know whether to change the base image or the application? Does it distinguish a vulnerable package that is installed from one that is actually used? How does it treat findings with no available fix? Can you set a base image policy? Does the SBOM it exports validate against the schema and list the same components it reports?
Integration and speed
Test scanning in CI, in the registry and on running workloads if you need that. Time a cold scan and a cached scan. Check how it authenticates to private registries, and how it handles rate limits. A scanner that needs special credentials per team will cost more effort than its price suggests.
Result handling
Findings need an owner. Ask how results map to the service and team, how duplicates across many images built from one base are grouped, and how exceptions are recorded. Fixing a base image once should clear hundreds of findings, and the tool should make that visible.
A last check is reproducibility. Scan the same digest twice, a day apart, and compare results. Differences should be explained by new advisory data, not by random behavior. Also scan an image you know contains a specific vulnerable package and confirm it is reported with the right version. Small sanity tests like these take minutes and catch tools that look polished but behave unpredictably under real conditions.
Try it yourself
Click through the demo and watch how the results change as you move through each step.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard scans container images and exports SBOMs, and a free scan is available to try.
Quick check
Should I scan images in CI or in the registry?
Both help. CI gives fast feedback, and registry scans catch new advisories on images that already shipped.
Last reviewed: 19 October 2026.
