A CVE scan matches the software and versions you use against published vulnerabilities. A misconfiguration scan checks settings, such as an open storage bucket or a privileged container, against a rule set. One asks whether your software has a known flaw, the other asks whether you set it up safely.
Side by side
| CVE scan | Misconfiguration scan | |
|---|---|---|
| Question | Is this version known to be vulnerable? | Is this setting unsafe? |
| Input | Packages, lockfiles, image contents, SBOM | Terraform, Kubernetes YAML, Dockerfiles, cloud settings |
| Data source | Advisory databases | Rule sets and benchmarks |
| Typical fix | Upgrade or patch | Change a setting |
| New findings appear | When advisories are published | When rules change or files change |
| Blind spot | Unpublished flaws, bad settings | Flaws inside the software itself |
Examples
A CVE finding: a library version you use has a published remote code execution advisory, and a fixed version exists. A misconfiguration finding: your Kubernetes manifest mounts a host path or runs a container as privileged, which the Pod Security Standards forbid at Baseline.
Why you need both
A fully patched system can still be exposed by a public bucket. A perfectly configured system can still run a vulnerable library. Neither scan sees the other problem, and neither tests your own business logic.
How their results age
CVE results change without any change to your code, because advisories are published daily. Run them on a schedule. Misconfiguration results change when someone edits a file, so run them on pull requests.
Deciding what to fix first
For CVEs, rank by severity, fix availability and reachability: is the vulnerable code called? For misconfigurations, rank by exposure: is it reachable from the internet, and what does it protect? See scanning a container image in CI for how scans connect to CI.
Steps
- Put dependency and image scanning on a schedule and on PRs.
- Put infrastructure and Dockerfile checks on PRs.
- Combine the results in one queue with an owner.
- Track time to fix for each type separately.
How Safeguard helps
Safeguard provides SBOM and dependency scanning with reachability analysis, and policies, gates and guardrails you can apply before merge. You can try the free scan on a repository.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings are grouped and prioritized in one queue.
Quick check
Can a CVE scan find a public bucket?
No. That is a configuration problem, found by misconfiguration scanning.
Which one needs a schedule?
CVE scanning, because new advisories change results without any code change.
Sources
- Kubernetes documentation, Pod Security Standards (fetched 19 October 2026).
Last reviewed: 19 October 2026.
