Your pipeline is green. The Docker build finished in ninety seconds, docker push sent the new tag to your registry without a hiccup, and the deployment rolled out before your coffee got cold. Three weeks later, a message lands in the security channel: acme/api:2.4.1 has 45 known vulnerabilities, …

You wire Trivy into the pipeline on a Friday afternoon, feeling pretty good about yourself. Monday morning the first scan lands: 450 vulnerabilities. Twelve critical, sixty-one high, the rest a wall of yellow and blue you don’t have the patience to read. You post the report in the team …