Rescan deployed images at least daily against fresh advisory data, and immediately when a new critical advisory is published for something in your inventory. The image does not change, but the vulnerability data does. A clean result at build time only describes what was known that day.
Why a deployed image goes stale
An image is a fixed set of layers. The packages inside do not change after build. What changes is the list of known flaws. A library that scored clean on Monday can have a published advisory on Thursday. If you only scan in CI, nobody looks at that image again until its next build, which for a stable service may be months away.
Two kinds of rescan
| Kind | What changes | Trigger |
|---|---|---|
| Rescan the same bytes | Advisory data | Schedule or new advisory |
| Rebuild and rescan | Base image and packages | New base image or dependency update |
The first tells you what is wrong. The second is how you fix it. Many teams do the first but forget the second, so findings pile up on images that are never rebuilt.
A workable schedule
- Scan on every build and block on your policy threshold.
- Rescan every deployed digest daily using stored inventories, not a fresh pull. This is cheap because it compares a known package list to updated data.
- Trigger an extra pass when a critical or actively exploited advisory appears.
- Rebuild long-lived images on a calendar, for example monthly, even when nothing is flagged.
- Alert owners, not a shared inbox. Findings without an owner do not get fixed.
What to alert on
Do not send every new finding. Send a notification when a finding is new, severe, fixable and present on a running image. A fix that exists but is not deployed is the most actionable kind. Our post on container scan results with hundreds of findings covers ordering.
What a rescan cannot see
A rescan reads the packages recorded in the image. It cannot see anything that was downloaded at runtime or configuration problems outside the image. See what container scanning cannot see.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a component that was clean gains a finding without any code change.
Safeguard keeps SBOM and dependency inventories and applies policies and gates, so a new advisory can be matched to existing inventory. Try the free scan first.
Quick check
Is a daily rescan expensive?
Not if you store the package inventory and compare it to updated data. Re-pulling and unpacking every image is the expensive way.
If a rescan finds a problem, do I patch the running container?
No. Rebuild from a fixed base or dependency and redeploy. Patching a live container leaves no record and is lost on restart.
Last reviewed: 19 October 2026.
