Scan re-evaluation process

Understand how Cortex Cloud re-evaluates container registry scan results.

After the initial scan completes, scan re-evaluation keeps container image findings up to date without requiring the image to be re-pulled or re-scanned.

Because container images are immutable, the software inventory and scan results from the initial scan are retained and reassessed as new information becomes available.

Scan re-evaluation occurs in the following scenarios:

• New vulnerability intelligence: When updated vulnerability intelligence becomes available, the stored software inventory of previously scanned images is matched against the updated data, and associated findings and risk scores are updated.
• Base image changes: When the base image used to build an image changes, affected images are reassessed to reflect the updated layer information.
• Updated malware verdicts: File verdicts for previously scanned images are periodically rechecked. If a file is later classified as malicious, a new finding is generated.

Scan re-evaluation applies to vulnerability and malware findings. Secrets and compliance findings are determined during the image scan and are updated only when the image is rescanned, such as after a scanner engine update.

Scan re-evaluation reduces resource-intensive rescans while keeping security assessments current and helping you identify and mitigate emerging risks in images stored in your registries.