Edit

View and remediate vulnerabilities for registry images (risk-based)

Note

These preview recommendations are going to be deprecated on April 13, 2026. Deprecation of preview of container and container images vulnerability recommendations

Note

This page describes the new risk-based approach to vulnerability management in Defender for Cloud. Defender for CSPM customers should use this method. To use the classic secure score approach, see View and remediate vulnerabilities for registry images (Secure Score).

Defender for Cloud offers you the capability to remediate vulnerabilities in container images while they're still stored in the registry. Additionally, it conducts contextual analysis of the vulnerabilities in your environment, aiding in prioritizing remediation efforts based on the risk level associated with each vulnerability.

Microsoft Defender for Cloud performs vulnerability assessment for container images and running containers across supported environments. Findings are surfaced as individual security recommendations in Defender for Cloud, generated based on the cloud provider, resource type (container registries or running containers), and the enabled Defender plans. Rather than relying on a fixed set of recommendations, Defender for Cloud dynamically evaluates container workloads and images and presents the relevant recommendations in the Recommendations experience, where they can be filtered and prioritized based on risk and scope. This approach ensures that vulnerability assessment results remain accurate and up to date as new environments, threats, and capabilities are introduced.

In this article, we review the Container images in Azure registry should have vulnerability findings resolved recommendation. For the other supported environments, see the parallel recommendations in Vulnerability assessments for supported environments.

View vulnerabilities on a specific container image

  1. Sign in to the Azure portal.

  2. Go to Microsoft Defender for Cloud > Recommendations.

  3. Search for the recommendation Container images in Azure registry should have vulnerability findings resolved.

    Screenshot showing the line for recommendation container registry images should have vulnerability findings resolved.

  4. Select the recommendation.

  5. Review the recommendation details.

    Screenshot showing the recommendation details and affected registries.

  6. Select the Findings tab to see the list of vulnerabilities impacting the registry image.

    Screenshot showing the list of vulnerabilities impacting the registry image.

  7. Select each vulnerability for a detailed description of the vulnerability.

    Screenshot showing the list of findings on the specific image.

To find all images impacted by a specific vulnerability, see Group recommendations by title.

For information on how to remediate the vulnerabilities, see Remediate recommendations.

Next step