Vulnerability Scanning

Overview#

Log4Shell took the world by surprise in December 2021, but organisations with comprehensive dependency scanning detected it in their environments within hours of disclosure. Those without it spent days manually auditing code repositories and container images, trying to figure out whether they were exposed. The gap between those two outcomes is largely a tooling problem.

Argus provides continuous vulnerability monitoring across application dependencies, container images, and infrastructure-as-code configurations. The platform identifies known vulnerabilities, assesses risk in context, and accelerates remediation through pull request generation and compatibility analysis. Security gates enforce standards at the CI/CD pipeline level, so vulnerable code cannot reach production without explicit sign-off.

Key Features#

• Dependency Vulnerability Scanning: Analysis of application dependencies across multiple programming languages and package managers identifies known vulnerabilities, including those buried deep in transitive dependency chains that other scanners miss.

• Container Image Security: Multi-layer analysis of container images detects vulnerabilities in base images, application packages, and operating system components, along with configuration issues and exposed secrets.

• Infrastructure-as-Code Security: Security analysis of infrastructure definitions catches misconfigurations, compliance violations, and best practice deviations before deployment, preventing security issues from reaching production.

• Contextual Risk Assessment: Each vulnerability is assessed in the context of your application, considering factors like exploit availability, whether the vulnerable code is reachable, data sensitivity, and exposure level to prioritise remediation efforts effectively.

• Automated Remediation: The platform generates pull requests with dependency updates, predicts breaking change likelihood, runs automated tests to validate fixes, and supports gradual rollout strategies for high-risk remediations.

• CI/CD Integration: Scanning integrates directly into your development pipeline, with configurable thresholds that can warn or block deployments based on vulnerability severity, ensuring security gates are enforced automatically.

• Continuous Monitoring: Ongoing vulnerability monitoring alerts you when new CVEs affect your existing dependencies, containers, or infrastructure, even between active scans.

How It Works#

Dependency Scanning#

The platform analyses your application's dependency manifest and lock files to build a complete dependency graph including all transitive dependencies. Each dependency is checked against multiple vulnerability databases for known CVEs, with severity scoring, exploit availability assessment, and remediation guidance.

Supported ecosystems include JavaScript/Node.js, Python, Java, Ruby, .NET, Go, Rust, PHP, and additional languages. Both direct and transitive dependencies are fully analysed.

Container Security#

Container images are analysed layer by layer, examining:

• Operating system packages for known vulnerabilities with fix availability
• Application dependencies embedded in the image
• Configuration issues such as running as root, exposed ports, or secrets embedded in layers
• Compliance violations against container security benchmarks
• Base image recommendations suggesting more secure or better-maintained alternatives

Infrastructure-as-Code Security#

Infrastructure definitions are analysed against security policies and compliance frameworks before deployment:

• Security misconfigurations such as overly permissive access controls, unencrypted storage, or public exposure
• Compliance violations against industry benchmarks and regulatory requirements
• Best practice deviations that could weaken security posture
• Automated fixes with corrected code for common misconfigurations

Remediation Automation#

When vulnerabilities are found, the platform accelerates remediation:

1. Risk Prioritisation: Vulnerabilities are ranked by contextual risk score considering severity, exploitability, exposure, and asset criticality
2. Fix Analysis: Available fixes are analysed for compatibility, with machine learning predicting breaking change likelihood
3. Pull Request Generation: Automated PRs include the dependency update, test results, and detailed explanation of the fix
4. Validation: Automated tests verify the fix does not introduce regressions
5. Deployment Guidance: Risk-appropriate deployment strategies are recommended, from immediate deployment to canary rollout

Open Standards#

• CVE (Common Vulnerabilities and Exposures): Every vulnerability record is identified and tracked using the MITRE CVE identifier scheme, enabling interoperability with all major vulnerability databases and security tooling.
• CVSS (Common Vulnerability Scoring System) v2 and v3: Both CVSS v2 and v3.x base scores are ingested, stored, and used to drive severity classification and contextual risk prioritisation across all scanning workflows.
• CWE (Common Weakness Enumeration): Weakness classifications are extracted from source data and stored against each CVE record, enabling root-cause analysis and pattern detection across vulnerability findings.
• CPE (Common Platform Enumeration) 2.3: Affected vendor and product information is parsed from CPE 2.3 URIs supplied by the NVD, allowing precise matching of vulnerabilities to software components in the asset inventory.
• NVD CVE JSON API 2.0: The platform integrates directly with the NIST National Vulnerability Database REST API (version 2.0) for continuous ingestion of newly published and modified CVE records.
• CISA Known Exploited Vulnerabilities (KEV) Catalogue: A dedicated connector consumes the CISA KEV JSON feed to flag vulnerabilities confirmed as actively exploited in the wild, surfacing them for immediate prioritisation.
• STIX 2.1 (Structured Threat Information eXpression): Vulnerability findings can be exchanged as STIX 2.1 vulnerability SDOs, with CVE identifiers and CVSS scores mapped to and from the STIX object model for integration with threat-intelligence platforms.

Compliance#

Vulnerability scanning supports compliance with:

• PCI-DSS: Vulnerability management requirements (Requirement 6.2)
• HIPAA: Security rule vulnerability analysis requirements
• SOX: IT general controls for software security
• FedRAMP: Continuous monitoring and vulnerability scanning
• ISO 27001: Technical vulnerability management (A.12.6.1)
• NIST 800-53: Vulnerability scanning controls (RA-5)
• SOC 2: Vulnerability management and patching controls

Integrations#

The scanning platform integrates with CI/CD pipelines, container registries, issue tracking systems, and developer tools to fit naturally into existing development workflows.

Availability#

• Enterprise Plan: Full vulnerability scanning suite included
• Professional Plan: Dependency scanning included; container and IaC scanning available as add-on

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14