How to have perfect vulnerability reports and still get hacked

The talk starts from the common assumption that organizations can know which known vulnerabilities sit inside their applications and container images. The speakers argue that this goal is harder than it sounds. Software composition analysis tools build an inventory by reading package metadata from an image, so anything without that metadata, such as a compiled web server binary copied in by hand, can disappear from the results. They describe this unexplained content as software dark matter, and note that many popular base images contain a large share of files that no bill of materials accounts for.

Next, they walk through the vulnerability databases that scanners rely on. Sources such as NVD, distribution security trackers and ecosystem advisories use different identifiers and scopes, so a package can be matched in one database and missed in another. A PostgreSQL build installed from its own vendor repository was not matched, because the Debian tracker only covers packages distributed by Debian maintainers. Backported fixes from enterprise distributions add further confusion, since version numbers alone can make patched software look vulnerable.

The closing section covers improvements: source-linked advisories, package URL and SWID identifiers, declarative image builders that produce complete SBOMs, minimal base images, runtime evidence for reachability, and machine-generated VEX statements. The takeaway is that these tools are useful but not silver bullets, so practitioners should learn where each one is blind and check results against their own environment.