How do you integrate real exploit intelligence into your container security strategy?

An approach we've taken is to use hardened base images and simply address CVEs as they come up. We even have a prototype automated patching tool we're testing internally, but honestly, it's a lot tougher than just starting off with a strong base image.

Think about moving towards weekly container rebuilds with update/upgrade commands built-in. Get solid testing in place, and work your way up to using hardened base images like WizOS or Docker hardened images. To tackle the backlog, suggest your security team factor in exploitability metrics (like EPSS or CISA KEV), reachability, and external exposure instead of relying purely on CVSS scores.

We had a similar mess with CVE alerts and switched to using Minimus for our base images. They actually filter vulnerabilities based on exploit intelligence rather than just CVSS scores, which made a huge difference. It integrates with CISA KEV and other threat feeds so we only get notified about things that are truly being exploited in the wild. This has reduced our noise by about 80%. Even though our security team still has their complaints, at least the issues they escalate are worth addressing.

Why not automate your image builds and just patch all your containers every week? It could save a lot of time and effort on your team.