A scan is a snapshot of an image against that day's advisory database. The image never changes, the database changes daily. So the only way to know if today's advisory hits last week's deployment is to scan everything again.

I built it the other way round:

A read-only agent watches pods and pulls each image once per digest, then stores its SBOM.

The server mirrors OSV, EPSS and CISA KEV locally.

When the mirror changes, every stored SBOM is re-matched. No image is pulled twice.

Each pod is tied back to its Helm release and Argo CD app, so the fix is a chart version, not a CVE id.

Hardest part was package URL matching. Go stdlib under GOEXPERIMENT gave 140 false positives in one release. Rocky and SLES matched nothing for months because Syft and OSV disagree on the rpm namespace.

It does not do config audit, RBAC or CIS benchmarks.…