Most Container Images You Pull Today Are Already Full of Vulnerabilities

Container image security has remained stuck on the same problem for a decade: scanning is easy, but remediation at scale is not. John Morello, co-founder of Minimus and former CTO of Twistlock, discusses why vulnerability sprawl persists — base images ship hundreds of unused packages, upstream fixes lag by months, and platform teams keep rebuilding bloated containers. Minimus addresses this by building hardened, minimal Docker images directly from upstream source using AI-assisted tooling on GCP and GitHub, resulting in dramatically smaller images with far fewer vulnerabilities. Morello also highlights that AI is now actively weaponized for vulnerability discovery, shrinking the window between disclosure and exploitation. Even large enterprises and government cloud environments continue running outdated, unpatched images at scale — not from ignorance, but because remediation costs have been unsustainably high.