Full Report
Wiz’s reimagined container image page gives teams complete visibility, smarter prioritization, and faster remediation, from code to runtime.
Analysis Summary
This context describes a product update from Wiz focusing on enhanced visibility and context for container image security across the build-to-runtime lifecycle. It does not detail specific malware families, offensive tools, or classic adversarial TTPs in the traditional sense (like exploitation techniques or C2 malware). Instead, it focuses on **defensive security capabilities** against misconfigurations and vulnerabilities within container environments.
Therefore, the summary will focus on the **Wiz Container Image Page** as the primary "tool/technique" described in the context of security operations.
# Tool/Technique: Wiz Container Image Page (Build to Runtime Visibility)
## Overview
The Wiz container image page is a security feature designed to provide platform and security teams with complete, context-aware visibility into container images throughout their lifecycle, from the initial build phase through to runtime deployment. Its purpose is to enable faster prioritization and remediation of risks associated with deployed images.
## Technical Details
- Type: Security Tool/Platform Feature
- Platform: Container Environments (CI/CD pipelines, Registries, Runtime environments)
- Capabilities: Full lifecycle tracking for container images, vulnerability tracing, blast radius calculation, and discovery of unmonitored registries.
- First Seen: August 19, 2025 (Date of article publication detailing the feature release/update)
## MITRE ATT&CK Mapping
Since this describes a defensive product feature rather than an offensive technique, direct mapping is difficult. However, the capabilities address detection and response related to the lifecycle adversary stages.
- **TA0005 - Defense Evasion** (Addressing gaps where malicious images might evade detection)
- **T1562 - Impair Defenses** (Closing visibility gaps that might allow threats to persist)
- **TA0007 - Discovery** (Locating deployed assets)
- **T1083 - File and Directory Discovery** (Discovering where images are deployed)
## Functionality
### Core Capabilities
- **Risky Base Image Surfacing:** Identifying base images contributing vulnerabilities and tracing their origin.
- **Deployment Mapping:** Determining exactly where images are deployed, how many containers rely on them, and identifying the "blast radius" of an issue.
- **Scanning Governance:** Tracking security scanning compliance across CI, registry, and runtime stages to spot policy gaps.
- **Registry Discovery:** Automatically uncovering all container registries within the cloud environment.
### Advanced Features
- **Lifecycle Visualization:** Mapping the entire journey of an image from Build to Production to validate security gates.
- **Risk Prioritization:** Prioritizing vulnerable images based on their actual deployment scope across critical workloads.
- **Root Cause Tracing:** Tracing a vulnerable image back to the source repository, Dockerfile, and build pipeline for faster fixing ("From Image to Code").
## Indicators of Compromise
(This section is not applicable as the content describes a security platform feature, not malicious artifacts.)
- File Hashes: N/A
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: N/A
- Behavioral Indicators: N/A
## Associated Threat Actors
(Not applicable. This feature is used by defenders, not associated with specific threat actors.)
## Detection Methods
(Not applicable. This is a set of detection/visibility capabilities.)
- Signature-based detection: N/A
- Behavioral detection: N/A
- YARA rules if available: N/A
## Mitigation Strategies
- **Vulnerability Management:** Ensuring timely patching based on risk severity determined by blast radius.
- **Shift-Left Security:** Using lifecycle visibility (CI scanning) to validate security gates before deployment.
- **Supply Chain Governance:** Monitoring base image provenance and usage.
- **Asset Inventory Hygiene:** Automatically discovering and monitoring all container registries.
## Related Tools/Techniques
- Container Vulnerability Scanning Tools
- Cloud-Native Application Protection Platforms (CNAPP)
- Software Supply Chain Security Platforms