With regards to hardening/ compliance checks there are easy checks then there are hard ones. The easy ones are, what permissions are set on files? What account is the app running as? And this account what privileges does it have? What about configs? What settings are written to these configs? The hard ones are: We need to ask the app via command line instructions and grep the standard out for the output. Or when you know what protocol is running on a port you then probe the protocol if its configured correctly like if SNMP uses the default community public & private strings. Or for a web admin panel and you want to test if it is using default credentials (fingerprinting that web app is also another matter). The reason I mention CPE is because vulnerability feeds use CPE naming to make it easier to parse and understand if the app version is indeed vulnerable and limit false positives. Keep in mind some OS back port patches so even then they may look vulnerable but are not. Finally in Slack I did mention container introspection. If you do this you will have a MASSIVE competitive advantage over other products. It is also a major concern for security teams and by including this you would allow for more teams to leverage containers with more confidence. Hope that helps.