Image scanning finds known flaws inside an image before it runs. Cluster scanning checks configuration and what is deployed. Runtime detection watches behavior while workloads execute. They answer different questions, so most teams need more than one, adopted in that order.
Definitions
- Image scanning: reads an image's layers, lists packages and matches them to advisories. Also finds secrets and bad settings in the image config.
- Cluster scanning: reviews the live cluster's configuration, such as RBAC, pod security settings, network policy and which images are running.
- Runtime detection: observes processes, files and network activity in running containers and flags unusual behavior.
Comparison
| Question | Image scan | Cluster scan | Runtime detection |
|---|---|---|---|
| Does this image contain a known vulnerable package? | Yes | Partly, if it reads images | No |
| Is a pod running as root or privileged? | Partly, from config | Yes | Sees effects |
| Which images are live right now? | No | Yes | Yes |
| Is a container doing something unusual? | No | No | Yes |
| Can it stop a bad deploy? | Yes, in CI | Yes, via admission | Rarely |
| Does it catch an unknown attack? | No | No | Sometimes |
When each one runs
Image scans run at build and again on a schedule. Cluster scans run continuously or on every change. Runtime detection runs while workloads are up. NIST's Application Container Security Guide, SP 800-190, covers images, registries, orchestrators, containers and the host as separate risk areas, which is a useful reminder that no single control spans all of them.
What each one misses
An image scan cannot see runtime downloads or a misconfigured cluster; our post what container scanning cannot see lists the gaps. Cluster scanning does not know which package versions are inside. Runtime detection is reactive and needs tuning to avoid noise.
A sensible order
- Image scanning in CI, blocking on a narrow policy.
- Rescanning of deployed images.
- Cluster configuration checks and admission rules.
- Runtime detection for the workloads that matter most.
Start where the cost is lowest and the signal clearest. Image scanning gives many teams their first useful list of work.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at what the scan reports and notice what it cannot tell you about the running system.
Quick check
Is runtime detection a replacement for scanning?
No. It sees behavior, not the full list of known flaws in images. They complement each other.
Where should a small team start?
With image scanning in CI plus a rescan of what is deployed.
Safeguard covers dependency and SBOM scanning and policies; it does not replace runtime detection tooling. Try the free scan.
Sources
Last reviewed: 19 October 2026.
