* [Blog](https://www.paloaltonetworks.com.au/blog) * [Cloud Security](https://www.paloaltonetworks.com.au/blog/cloud-security/) * [Cloud Native Application Platform](https://www.paloaltonetworks.com.au/blog/cloud-security/category/cloud-native-application-platform/) * Cut Container Remediation... # Cut Container Remediation Time in Half with Smart Upgrade Intelligence [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fcloud-security%2Fcortex-cloud-smart-upgrade-intelligence%2F) [](https://twitter.com/share?text=Cut+Container+Remediation+Time+in+Half+with+Smart+Upgrade+Intelligence&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fcloud-security%2Fcortex-cloud-smart-upgrade-intelligence%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fcloud-security%2Fcortex-cloud-smart-upgrade-intelligence%2F&title=Cut+Container+Remediation+Time+in+Half+with+Smart+Upgrade+Intelligence&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com.au/blog/cloud-security/cortex-cloud-smart-upgrade-intelligence/&ts=markdown) \[\](mailto:?subject=Cut Container Remediation Time in Half with Smart Upgrade Intelligence) Link copied By [Ory Segal](https://www.paloaltonetworks.com/blog/author/ory-segal/?ts=markdown "Posts by Ory Segal") and [Mohit Bhasin](https://www.paloaltonetworks.com/blog/author/mohit-bhasin/?ts=markdown "Posts by Mohit Bhasin") Sep 16, 2026 6 minutes [Cloud Native Application Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-native-application-platform/?ts=markdown) [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown) [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown) [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) Over the last few years, a distinct paradox has emerged in cloud-native security: our scanning tools have become incredibly accurate, yet our mean time to remediate (MTTR) has stalled. Container image vulnerabilities have become a wall of non-actionable noise. Today, legacy cloud security tools and exposure management solutions will easily scan your environment to flag hundreds of Common Vulnerabilities and Exposures (CVEs) on a single image. They will even provide a generic "fix version" next to a package name. But for security, platform engineering, and application development teams, that's where the real work and friction begins. When you are staring at 250 vulnerabilities on a single container image, you immediately hit a wall of contextless data. Scan tools routinely display "fixed versions" for base-image CVEs, but developers can't simply override those packages; they must wait for a newer base image. Do these vulnerabilities originate from your team's golden base image, or were they introduced by the application developers when they added third-party libraries? More importantly, what is the safest upgrade path that actually fixes these CVEs without breaking production? Telling an engineer *what* is broken is the bare minimum. We need tools that tell us *how* to safely fix it. To bridge this gap, Cortex Cloud is accelerating vulnerability remediation across your container fleet with a new smart Upgrade Intelligence summary, available directly on container registry image assets. Cortex Cloud now automatically identifies the underlying base OS image, isolates the scope of every CVE, and evaluates newer, more secure versions already approved within your corporate registry. Let's look at how this fundamentally changes container vulnerability management. ## **The Root Cause: Ending the Container Blame Game** If you sit in on a vulnerability triage meeting, you will witness the exact same bottleneck of ownership ambiguity. When application developers investigate vulnerability findings, they often see dozens of critical CVEs living in the base operating system layer (e.g., a vulnerability in libc or openssl). If teams don't control the base infrastructure, they ignore the report. Conversely, platform engineers receive massive lists of CVEs that include application-layer packages (like lodash or log4j), which cannot be safely patched without breaking the app. As a result, vulnerability counts continue to increase quarter over quarter despite massive investments in scanning. Cortex Cloud eliminates this friction by classifying the base image within the scope of every containerized application. Driven by advanced SBOM (Software Bill of Materials) analysis, the engine evaluates the package type and its origin to classify it as either **Application Scope** or **Base OS Scope**. * **For the Application Developer:** Teams can now filter their vulnerability view by application. This strips away infrastructure noise, showing only the CVEs in packages they own, along with the specific version they need to upgrade. From here, teams can easily update their package.json or requirements.txt and fix their code without touching the underlying OS. * **For the Platform Engineer / DevOps:** Groups can filter by "Base OS" to see only the infrastructure vulnerabilities they are responsible for. This simplifies the backlog, allowing them to quickly roll out a new base OS image. ## **Intelligent Migration Scoring and Risk Assessment** In the past, teams were given a fixed version for a specific package, but they completely failed to assess the systematic safety of upgrading an entire base image. Cortex Cloud introduces container image migration scores, which weigh security posture improvements against potential operational risks. When a user opens the new Upgrade Recommendations modal, they are presented with the optimal upgrade path. The platform evaluates several vectors to provide an Operational Risk Level (Low, Medium, or High). This risk level factors in version distance (e.g., a patch upgrade vs. a major breaking version shift) and distribution compatibility. Furthermore, an upgrade recommendation will never be surfaced if it increases the critical CVE count compared to the current image. Inside the modal, teams instantly see: * **The Recommended Target:** The specific image tag or package version to upgrade to. * **Operational Risk Level:** The quantified risk of making the change. * **Remediation Impact:** The exact number of Critical, High, Medium, and Low CVEs that will be resolved by taking this single action. By eliminating hours previously spent researching safe base image tags and cross-referencing CVE databases, teams can transition straight from visibility to action. With clear scope definitions and risk-assessed upgrade targets, organizations are effectively cutting their mean-time-to-remediate (MTTR) in half. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/09/word-image-368209-1.png) Figure 1: Vulnerability Findings by Base OS ## **Remediation Leverage: Minimize the Blast Radius** If you have limited cycles to patch infrastructure, you need to know which actions provide the highest return on investment. When analyzing a shared base image (like a Golden Base or a Runtime Stack), Cortex Cloud traverses the graph relationships of your registry to calculate the image's blast radius. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/09/word-image-368209-2.png) Figure 2: Recommended Image Upgrade Plan The intelligence summary displays the exact number of downstream, dependent images that will inherit the base image security fixes once it is tagged. This is presented as a primary headline element in the UI. Instead of treating every vulnerability equally, teams can prioritize the single base image upgrade that cascades fixes down to 40, 50, or 100 downstream microservices. By framing the upgrade as a high-leverage security win, teams can minimize the blast radius and improve MTTR. To bridge the gap between intelligence and daily developer workflows, all of this data is highly exportable. Cortex Cloud instantly generates a detailed CSV remediation table---mapped precisely by scope, package, current version, recommended version, and CVEs fixed. This export is designed to be immediately usable as a Jira ticket list or team assignment sheet, transforming abstract vulnerability data into tangible engineering tasks. ## **The New Standard for Container Security** For too long, the industry has accepted that container vulnerability management means drowning in unactionable findings. Cortex Cloud is shifting the paradigm with intelligent upgrade recommendations. Moving beyond simply pointing out what is broken and finally giving teams the intelligence they need to safely and rapidly fix it. Learn more on the Cortex Cloud [Container and Kubernetes security page](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security). *** ** * ** *** ## Related Blogs ### [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) [#### Your Riskiest Kubernetes Workload Is Hiding in Plain Sight](https://www.paloaltonetworks.com.au/blog/cloud-security/your-riskiest-kubernetes-workload-is-hiding-in-plain-sight/) ### [Cloud Native Application Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-native-application-platform/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [#### Maturing Your Cloud Security Program](https://www.paloaltonetworks.com.au/blog/cloud-security/maturing-your-cloud-security-program/) ### [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) [#### Neutralize Cloud Threats, Stop the Attack Path](https://www.paloaltonetworks.com.au/blog/cloud-security/neutralize-cloud-threats-stop-the-attack-path/) ### [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Cloud-Native Application Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-native-application-protection-platform/?ts=markdown) [#### Stop Evasive Cloud Threats with Agentless Malware Sandboxing](https://www.paloaltonetworks.com.au/blog/cloud-security/agentless-malware-sandboxing/) ### [CDR](https://www.paloaltonetworks.com/blog/cloud-security/category/cdr/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [#### MCP Servers Are the New Unmanaged API. Start Treating Them That Way.](https://www.paloaltonetworks.com.au/blog/cloud-security/mcp-servers-ai-attack-surface-security/) ### [CDR](https://www.paloaltonetworks.com/blog/cloud-security/category/cdr/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [#### How the Latest Frontier AI Models Are Driving the Need for Real-Time Cloud Security](https://www.paloaltonetworks.com.au/blog/cloud-security/frontier-ai-models-real-time-cloud-security/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com.au/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language