What it means
Cloud environments combine customer-managed software with provider-managed components. The organization must understand which layers it can patch, reconfigure, replace, or escalate to the provider.
Why it matters
Rapid deployment and ephemeral workloads make asset inventory and ownership as important as scanning technology.
Practical focus
- Discover assets through cloud APIs and deployment pipelines
- Scan images and dependencies before deployment
- Prioritize reachable and privileged workloads
- Replace or rebuild ephemeral assets rather than patching them indefinitely
Common mistakes
- Scanning only long-lived virtual machines
- Treating provider-managed layers as customer patch obligations
- Ignoring vulnerable images after running containers disappear
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: