Automated process of identifying known vulnerabilities in code, dependencies, containers, and infrastructure before they reach production.
Vulnerability scanning automatically identifies known security weaknesses in code, dependencies, and configurations. It's an essential component of DevSecOps.
| Type | What it analyzes | When |
|---|---|---|
| SAST | Source code | Pre-commit, CI |
| SCA | Dependencies | CI, scheduled |
| Container | Docker images | CI, registry |
| IaC | Terraform, CloudFormation | CI |
| DAST | Running application | Staging, prod |
| Category | What it scans | Tools | Phase |
|---|---|---|---|
| SAST | Source code | Semgrep, SonarQube, CodeQL | PR / build |
| SCA | Dependencies | Snyk, Dependabot, Trivy | PR + daily |
| Container | Container images | Trivy, Grype, ECR scanning | Image build |
| IaC | Infrastructure as code | Checkov, tfsec, KICS | PR / plan |
- scan-dependencies: snyk test
- scan-code: semgrep --config auto
- scan-container: trivy image myapp:latest
- gate: fail if critical vulnerabilitiesAutomated vulnerability scanning is the first line of defense against compromised dependencies and insecure container images. Integrated into the CI/CD pipeline, it detects issues before they reach production.
Integration of security practices throughout the software development lifecycle, automating security controls in the CI/CD pipeline.
Continuous Integration and Continuous Delivery/Deployment — practices that automate code integration, testing, and delivery to production. Foundation of modern software engineering.
Practices for ensuring the integrity and security of all dependencies, tools, and processes comprising the software development pipeline.