4.2The Three Scanning Vectors

Vector	Example	Detection Method
OS packages	OpenSSL CVE in base image	Image layer scanning (Trivy, Grype)
Language dependencies	Vulnerable npm/pip/gem package	SBOM analysis + advisory database
Misconfigurations	Running as root, exposed ports	Dockerfile linting (Trivy config, Hadolint)

A comprehensive scanning strategy covers all three. Most teams start with image scanning and add configuration scanning as they mature.