# Subimage Blog

> Updates from Subimage, the open-core security graph.

Canonical HTML page: https://www.subimage.io/blog

---

- [How Corelight automated security alert triage with Subimage](https://www.subimage.io/blog/corelight-case-study.md) (2026-07-22): Corelight's autonomous triage agent had 30 tools to choose from. It used the Subimage graph twice as often as anything else.
- [Adding Scaleway to Cartography without rewriting vulnerability management](https://www.subimage.io/blog/full-chain-vulnerability-management-2026.md) (2026-07-21): How shared graph concepts let a new cloud provider reuse the existing path from a running container to a CVE, fix, source repository, and owner.
- [Screwing up vulnerability management at scale, and building a startup to fix it](https://www.subimage.io/blog/screwing-up-vuln-mgmt-at-scale.md) (2026-07-13): Introducing Subimage Issues: the vulnerability remediation loop I always needed but could never build
- [What it's like being the only security company in your YC batch](https://ventureinsecurity.net/p/what-its-like-being-the-only-security) (2026-06-18 on Venture in Security): Alex Chantavy's guest post on Venture in Security about building Subimage through YC and why security startups follow a different playbook.
- [Shift-right: attack path analysis that never wastes a good incident](https://www.subimage.io/blog/shift-right-attack-paths.md) (2026-04-09): Each incident response should leave fewer attack paths than the last
- [Cartography inventories AI agents in cloud environments](https://cartography.dev/blog/aibom) (2026-03-12 on Cartography): Alex Chantavy's Cartography post on using AIBOM scans and infrastructure graph context to find AI agents, the tools they use, and what they can reach.
- [How Veriff Evaluated React2Shell Risk Across 600 Repos in Minutes With Subimage](https://www.subimage.io/blog/veriff-case-study.md) (2026-01-20): 7 million findings and a different approach
- [How we used Subimage to fix React2Shell on our own infrastructure](https://www.subimage.io/blog/react2shell.md) (2025-12-08): How we used Subimage to fix React2Shell on our own infrastructure
- [We've raised $4.2M](https://www.subimage.io/blog/funding.md) (2025-10-20): We're funded, and here's where we're going next!
- [Unifying the Graph: Why We Introduced an Ontology in Cartography](https://blog.jychp.me/unifying-the-graph-why-we-introduced-an-ontology-in-cartography-33b9301de22d) (2025-06-16 on Medium): How Cartography's ontology adds a shared semantic layer for correlating users, devices, vulnerabilities, and other entities across data sources.