# Vulnerability Management

> Cloud vulnerability management that ranks every CVE by whether it's exploitable in your environment, routes it to its owner and opens the fix as a PR.

Canonical HTML page: https://www.subimage.io/product/vulnerability-management

---

Stop sorting CVEs. Start merging fixes.

Subimage scans every image you run, plus code and anything else with a filesystem. Each CVE is ranked by whether it's exploitable in your environment, routed to the team that owns it and fixed with a pull request.

Demo video: An issue for a CVE in a container image that is actually running, so the ranking is about whether it is exploitable in this environment rather than a raw score. The graph explorer draws the path from that CVE to the workload, and you talk to the agent, which opens a pull request that refreshes the base image.

## Container image scanning, traced to what's running

Container vulnerability scanning links each CVE to its package, its image and the pod, ECS task, Cloud Run service or Lambda running it.

Already run Wiz, Orca, Amazon Inspector, Dependabot, CrowdStrike, SentinelOne, Semgrep or Socket? Their findings join the same graph, VMs and laptops included.

## An SBOM for every image, one query away

- Every scanned image gets a software bill of materials (SBOM), plus an AI bill of materials when it carries AI packages.
- When the next bad package drops, "where do we run this version?" is one Cypher query across every image and repo.
- Repos pinned to a Shai-Hulud release get flagged. So do npm ranges that could pull one on the next install.

## Exploitable, not just installed

- A KEV-listed CVE on an internet-exposed service outranks a CVSS 9.8 in an image whose code never calls it.
- Every issue is scored on eight dimensions, each with a written reason. Together they answer four questions: can it be exploited, can an attacker reach it, what breaks if they do, and how hard is the fix?
- Code reachability checks whether your code actually loads or calls the vulnerable package.
- Think a score is wrong? Override it. The next sync keeps your call.

## Routed, fixed and closed without a spreadsheet

- Every CVE on a service image rolls up into one issue, sent to the team that owns it in Slack, Linear or Jira.
- Fixes arrive as pull requests: base image bumps that list the CVEs they clear, dependency bumps, Terraform fixes and fixes for vendor images.
- The analyst agent works the queue 24/7. Nothing merges without your review.
- The next hourly sync closes what got fixed. If a CVE comes back, the issue reopens with its full history.

## Bring your noisiest image.

Point us at the account it runs in and the repo that builds it. We'll show you which of its CVEs are exploitable, who owns them and the pull request that clears them.

[Book a demo](https://cal.com/team/subimage/chat-with-subimage)