Image Vulnerability Report

---
name: image-vulnerability-report
enabled: true
description: |
  Use when performing image vulnerability report — generates a detailed
  vulnerability report for container images across a registry or set of
  repositories. This template aggregates scan results, tracks remediation
  progress, and provides executive-level summaries of the organization's
  container security posture over time.
required_connections:
  - prefix: registry
    label: "Container Registry"
  - prefix: scanner
    label: "Vulnerability Scanner"
config_fields:
  - key: registry_url
    label: "Registry URL"
    required: true
    placeholder: "e.g., gcr.io/my-project"
  - key: report_scope
    label: "Report Scope"
    required: true
    placeholder: "e.g., All production images"
  - key: reporting_period
    label: "Reporting Period"
    required: false
    placeholder: "e.g., March 2026"
features:
  - VULNERABILITY_REPORT
  - CONTAINER_SECURITY
  - SRE_OPS
---

# Image Vulnerability Report

## Phase 1: Inventory

Enumerate all images in scope.

- [ ] Total images in registry: ___
- [ ] Images actively deployed in production: ___
- [ ] Images with latest scan <7 days old: ___
- [ ] Images never scanned: ___
- [ ] Images with no active deployments (candidates for cleanup): ___

| Image Repository | Tags | Last Scan | Deployed | Base OS |
|-----------------|------|-----------|----------|---------|
|                 |      |           |          |         |

## Phase 2: Vulnerability Aggregation

Aggregate findings across all scanned images.

**Fleet-wide Summary:**

| Severity | Total Findings | Unique CVEs | Fix Available (%) | Images Affected |
|----------|---------------|-------------|-------------------|-----------------|
| Critical |               |             |                   |                 |
| High     |               |             |                   |                 |
| Medium   |               |             |                   |                 |
| Low      |               |             |                   |                 |

**Top 10 Most Common CVEs:**

| CVE ID | Severity | Package | Images Affected | Fix Available | Age (days) |
|--------|----------|---------|-----------------|---------------|------------|
|        |          |         |                 |               |            |

## Phase 3: Risk Assessment

- [ ] Identify images with Critical/High CVEs that are internet-facing
- [ ] Cross-reference CVEs against known exploit databases (CISA KEV)
- [ ] Assess blast radius for each critical finding
- [ ] Identify shared base images that amplify risk

**Risk Matrix:**

| Risk Level | Criteria |
|------------|----------|
| Critical | Known exploited CVE in internet-facing production image |
| High | Critical CVE with fix available in production image |
| Medium | High CVE in production or Critical in non-production |
| Low | Medium/Low CVE or finding in non-production only |

## Phase 4: Trend Analysis

Compare to previous reporting period.

| Metric | Previous Period | Current Period | Trend |
|--------|----------------|----------------|-------|
| Total Critical CVEs | | | |
| Total High CVEs | | | |
| Mean time to remediate (Critical) | | | |
| Mean time to remediate (High) | | | |
| Images with zero Critical/High | | | |
| Scan coverage (%) | | | |

## Phase 5: Remediation Tracking

| CVE/Finding | Affected Images | Owner | Status | Target Date | Notes |
|-------------|----------------|-------|--------|-------------|-------|
|             |                |       |        |             |       |

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

### Executive Summary

- **Total images scanned:** ___
- **Scan coverage:** ___%
- **Critical findings requiring immediate action:** ___
- **Mean time to remediate (Critical):** ___ days
- **Security posture trend:** Improving / Stable / Declining

### Action Items

- [ ] Remediate all Critical CVEs with known exploits within 48 hours
- [ ] Patch remaining Critical CVEs within 7 days
- [ ] Scan all unscanned images and add to pipeline
- [ ] Clean up unused images from registry
- [ ] Update shared base images to patched versions
- [ ] Report posture to security leadership