cloudthinker-ai Image Vulnerability Report
Phase 1: Inventory
Enumerate all images in scope.
- Total images in registry: ___
- Images actively deployed in production: ___
- Images with latest scan <7 days old: ___
- Images never scanned: ___
- Images with no active deployments (candidates for cleanup): ___
| Image Repository | Tags | Last Scan | Deployed | Base OS |
|---|---|---|---|---|
Phase 2: Vulnerability Aggregation
Aggregate findings across all scanned images.
Fleet-wide Summary:
| Severity | Total Findings | Unique CVEs | Fix Available (%) | Images Affected |
|---|---|---|---|---|
| Critical | ||||
| High | ||||
| Medium | ||||
| Low |
Top 10 Most Common CVEs:
| CVE ID | Severity | Package | Images Affected | Fix Available | Age (days) |
|---|---|---|---|---|---|
Phase 3: Risk Assessment
- Identify images with Critical/High CVEs that are internet-facing
- Cross-reference CVEs against known exploit databases (CISA KEV)
- Assess blast radius for each critical finding
- Identify shared base images that amplify risk
Risk Matrix:
| Risk Level | Criteria |
|---|---|
| Critical | Known exploited CVE in internet-facing production image |
| High | Critical CVE with fix available in production image |
| Medium | High CVE in production or Critical in non-production |
| Low | Medium/Low CVE or finding in non-production only |
Phase 4: Trend Analysis
Compare to previous reporting period.
| Metric | Previous Period | Current Period | Trend |
|---|---|---|---|
| Total Critical CVEs | |||
| Total High CVEs | |||
| Mean time to remediate (Critical) | |||
| Mean time to remediate (High) | |||
| Images with zero Critical/High | |||
| Scan coverage (%) |
Phase 5: Remediation Tracking
| CVE/Finding | Affected Images | Owner | Status | Target Date | Notes |
|---|---|---|---|---|---|
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Executive Summary
- Total images scanned: ___
- Scan coverage: ___%
- Critical findings requiring immediate action: ___
- Mean time to remediate (Critical): ___ days
- Security posture trend: Improving / Stable / Declining
Action Items
- Remediate all Critical CVEs with known exploits within 48 hours
- Patch remaining Critical CVEs within 7 days
- Scan all unscanned images and add to pipeline
- Clean up unused images from registry
- Update shared base images to patched versions
- Report posture to security leadership