Live webinarWebinar with Jason Lee, Tue, Oct 13Your newest insider is an AI agent.Jason LeeFormer CISO, Zoom & SplunkRegister

Every image, scanned on push.

Every image scanned on push, the CVEs an attacker can reach first.

Try the cloudBook a demo
checkout-apiContainer securityDemo project
  • HighCVE-2023-5363 in openssl 3.1.3-r0api-server:v2.4.1

    In the base image, reached by the TLS listener in prod-eu.

    FROM node:18-alpine3.18FROM node:18.19.1-alpine3.19

    Fix readyBase bumped to node:18.19.1-alpine3.19, image rebuilt as v2.4.2, 0 reachable CVE.

Every layer read, the reachable first.

  • OS packages

    • alpine 3.18
    • openssl 3.1.3-r0

  • Malware, secrets, misconfigurations

    • /app/.env
    • USER root

  • Reachable CVEs first

    • CVE-2023-5363
    • api-server:v2.4.1 :443

  • Base image bumps

    • node:18-alpine3.18
    • node:18.19.1-alpine3.19

The CVE that matters, before the others.

Every CVE in the image

  • Alert: CVE-2023-5363 in openssl 3.1.3-r0
  • Alert: Windows-only CVE on a Linux image

What an attacker can reach

  • High: CVE-2023-5363 in openssl 3.1.3-r0api-server:v2.4.1
  • Medium: Two base-image CVEs, grouped into onebilling-worker:3.2.0
  • Dropped: Windows-only CVE on a Linux imageapi-server:v2.4.1

Connect a registry, the rest is automatic.

Images are pulled and scanned in our pods, on push and on schedule, never in your CI.

  1. Your registryDocker Hub, ECR, ACR, GCR, GHCR, Quay, Harbor, JFrog or Scaleway.Pushed
  2. Our podsPull the image, never your CI.Pulled
  3. The layersOS packages and app dependencies, read.Found
  4. The fixA base-image bump, as a pull request.Fix ready

Start with one repository.

Connect GitHub, GitLab, Bitbucket or Azure DevOps, pick a repository, and the first scan starts.

Try the cloudBook a demo

In detail

Every layer of the image, read.

  • OS packages

    Alpine, Debian, Ubuntu, RHEL and UBI base layers.

  • App dependencies

    npm, PyPI, Maven, Go modules, Cargo, NuGet and Composer, inside the image.

  • Malware, secrets, misconfigurations

    Found in the layers too, not only CVEs.

  • Reachable CVEs first

    What is invoked and exposed in production comes first.

  • Base image bumps

    Cybe AutoFix opens a Dockerfile pull request with the new pinned digest.

  • CIS benchmarks

    CIS Docker and Kubernetes Benchmarks, built in.

Everything it checks

Container scanning without the alert pile.

  • Pull-once, scan-everywhere

    Every image in every registry you connect is pulled and scanned by our pods, on push and on schedule.

  • AI triage out of the box

    Cybe Analysis sits between the raw CVE feed and your dashboard.

  • Findings live where you work

    Routed to Jira, GitHub Issues, GitLab Issues and Slack. The unified dashboard stays the source of truth across SAST, SCA, secrets, IaC, CI/CD and containers.

Five checks on every image you ship.

OS packages and app dependencies, across every major registry, with AI triage.

  • Every major registry

    Connect Docker Hub, Amazon ECR, Azure ACR, Google GCR, GitHub GHCR, Red Hat Quay, Harbor, JFrog Artifactory or Scaleway Registry.

  • OS packages plus app dependencies

    OS-level packages (Alpine, Debian, Ubuntu, RHEL/UBI) and application-level dependencies (npm, PyPI, Maven, Go modules, Cargo, NuGet, Composer) all in the same scan.

  • AI triage on every CVE

    Cybe Analysis re-scores raw CVE matches, drops obvious noise, groups recurring patterns by base image and contextualises by exposure.

  • Autofix base-image bumps

    When a base image upgrade clears a class of CVEs, Cybe AutoFix opens a Dockerfile PR with the new pinned digest and a regression note.

  • Continuous Compliance

    CIS Docker and Kubernetes Benchmarks built in.

From layer to fix

  • One layer, one CVE.

    Flagged at the layer that pulled it in.

  • Judged at runtime.

    Invoked and exposed in prod, so it comes first.

  • Rebuilt clean.

    Base bumped, image rebuilt, the gate green.

Registries CybeDefend pulls from

We pull from Docker Hub, ECR, ACR, GCR, GHCR, Quay, Harbor, JFrog and Scaleway. Push-time triggers and scheduled sweeps run in our pods, never in your CI. Findings flow into the unified dashboard, your Jira and your Slack.

  • Registries

    Docker Hub, Amazon ECR, Azure ACR, Google GCR, GitHub GHCR, Red Hat Quay, Harbor, JFrog Artifactory, Scaleway and any OCI registry.

  • Credentials

    Scoped per project and encrypted at rest. Pulls stay in our pods.

  • Where findings go

    The dashboard, Jira, GitHub Issues, GitLab Issues and Slack.

Frequently asked about CybeDefend Container.

Which registries do you integrate with?
Docker Hub, Amazon ECR, Azure ACR, Google GCR, GitHub GHCR, Red Hat Quay, Harbor, JFrog Artifactory and Scaleway Registry. Self-hosted registries that speak the OCI Distribution spec are reachable through the same connector.
How is a scan triggered?
Once a registry is connected, push events trigger a scan in our pods. Scheduled sweeps re-pull every image at a configurable cadence so newly disclosed CVEs are matched against your inventory automatically. You can also kick a scan off on demand from the dashboard or the CLI.
What does the autofix look like?
When a base-image bump clears a class of CVEs, Cybe AutoFix opens a Dockerfile PR with the new pinned digest and a short rationale. The PR is reviewable, mergeable and CI-gated like any other change in your repo.
How are credentials handled?
Registry credentials are scoped per project, encrypted at rest and rotated through the same secret store you already use. Pulls happen in our pods, never on a runner you'd otherwise have to harden, so registry secrets never leave the platform.