Get real about container security: 4 essential practices to manage risk

This report highlights widespread security debt in containerized environments, citing research that typical images contain hundreds of known vulnerabilities and multiple misconfigurations, compounded by opaque supply chains and manifestless components. It urges four core practices—controls for open-source AI risks, just-in-time access management, SBOM-driven dependency visibility, and stronger runtime security—alongside securing the SDLC with threat modeling, code reviews, SAST/DAST/SCA, and complex binary analysis; supporting data and examples include issues found in open-source AI models and Gartner guidance on JIT access.