How Warden finds vulnerabilities · Docs

Warden is built to know what software runs in your AWS accounts and Kubernetes clusters, to learn of new advisories from a signed feed, and to show first the few an attacker could use against you. This page describes the design. An early access install does not download the feed yet and shows no vulnerability findings; the Vulnerabilities page lists what exists in the product today.

The target is a finding on the page within the hour of the feed learning of an issue, for installs that fetch on the live schedule. That is a target about the page. Notices follow once the rules leave shadow on an install, which is the period in which a rule only records what it would have raised.

Sources

Two kinds of source meet in the install.

What runs is read by the watching identity, which never writes: Amazon Inspector findings and coverage, ECR scan results, running image digests, Systems Manager package lists of managed instances, Lambda runtimes and layers, EKS and add-on versions, managed database and data-service engine versions with AWS’s pending updates, machine images, and Elastic Beanstalk platforms. Everything is a read-only control-plane call. Warden installs no agent and sends no traffic to your workloads.

What is known comes from the advisory feed: public databases such as OSV, the National Vulnerability Database, CISA’s known-exploited list and EPSS, vendor advisories from Amazon Linux, Bottlerocket, Red Hat, Ubuntu and Debian, lifecycle dates, and advisories a curator writes from security mailing lists and project announcements, often before a CVE number exists.

What it does not read

Image layers, manifests and image configurations.
ECS task definitions, which can hold environment values.
Lambda code and layer contents.
Inspector code snippets, and the contents of Systems Manager custom or file inventory.

The watching identity can read Lambda environment values in the function listing, and ECS overrides in a task description, because AWS returns them with the call. Code drops them whole on arrival, before anything is stored or shown. The security model says so plainly.

Knowledge states

Each running thing carries one state, computed by code from what was read. A thing that could not be read is never reported as clear.

Packages: The operating system packages were read. It cannot see the libraries inside applications.
Software list: A software list exported from Inspector was read.
Scanner: Only a scanner's findings exist. Its silence counts only for advisories older than its last scan.
Versions: Platform, engine, runtime, kernel or node versions are known, not packages.
Declared: Only the identity of a curated official image is known.
None: Nothing could be read, with the reason and what turning it on would cost. It is never reported as clear.

“None” always comes with its reason, such as Inspector being off in a region, and with what turning it on would cost.

Which source answers for which software

A source answers only for the software it lists completely.

Software	The source that can say it is not affected	Without it
Operating system packages of an instance	Systems Manager’s package list	Inspector’s findings, which say only what the scanner reported
Libraries inside an application, a container image or a Lambda function	A software list exported from Inspector	The scanner’s findings. A component missing from them is “scanner reports none”, never “not affected”
Platform, engine, runtime and node versions	The AWS API for that service	Nothing: the version is known directly
A curated official image	The image’s declared identity	A weaker match, ranked lower

A host’s operating system package list never answers for the Java, npm or Python libraries inside its applications.

Matching

An advisory names software by an identity: a package URL for packages, a distribution kernel, a CPE product for runtimes and servers that no distribution package owns, an AWS engine and version, or a Kubernetes component. Names are normalised by fixed rules per ecosystem, and version ranges are compared by the ecosystem’s own ordering.

Distribution backports are respected: a distribution’s fixed version beats the upstream range.
Where Inspector or ECR scanning covers a resource, its finding is the record shown for each advisory it reports, with its fixed version. Warden’s own match stays, tagged, where the scanner does not report that advisory.
Matches rest on stated confidence. A match on an image name alone ranks lower than one on a package version.
Withdrawals and narrowings in the feed never close an open finding by themselves.

Ranking

Code decides every rank from typed facts, and no model output raises or lowers one. The facts are these.

Exploited: Seen on this resource after the vulnerable version started running; listed as exploited in the wild; or a public exploit or a high exploit-prediction score exists.
Exposure: A proven path from the internet to the workload. When the estate graph is incomplete the page says it could not tell, and why.
Power: Whether the workload's identity reaches administrator rights or a data store, or the pod is privileged.
Impact: Takeover, partial or unknown, from the feed, never guessed.
Running: Running now, deployed but stopped, or only in a registry.

The first row that holds wins.

Band	When
Fix now	Exploitation is seen on the resource itself; or a flaw on CISA's known-exploited list (or a curator's signed statement that it is being exploited) runs on something reachable from the internet or on a workload whose identity can reach administrator rights; or a malicious package is confirmed by its artefact.
This week	A flaw on the known-exploited list is running anywhere; a public exploit exists for a takeover flaw on an exposed or powerful workload; or a platform is past its end of support with no security fixes and is exposed.
Plan	A public exploit exists, or a takeover flaw is exposed; end of support within 90 days; an AWS security update is waiting; or the software is not running.
Long tail	Everything else.

Feed facts alone never make a case Under attack and never take an action. A new head that would raise an unusual number of new high or critical findings is held for a keeper to release.

What to enable in AWS

With no option turned on, Warden already knows platform, engine, runtime, node and image versions, AWS’s pending updates and end-of-support dates. The options below add package-level depth. None is required, and Warden turns none of them on. Each price is AWS’s list price in us-east-1, checked on 23 October 2026, billed by AWS to your account. AWS sets and changes prices, so check AWS’s price list before turning anything on.

Amazon Inspector

What it adds: Package-level flaws on instances without Systems Manager, inside container images and inside Lambda packages, with the fixed version.
What you turn on: Inspector, per resource type and region.
AWS's price: About USD 1.26 per EC2 instance a month. Images: about USD 0.09 for the first scan, USD 0.01 per rescan. Lambda: about USD 0.30 per function a month, and about USD 0.60 more with code scanning, USD 0.90 together.

ECR scanning

What it adds: Operating system package flaws in images pushed to ECR, when Inspector is off.
What you turn on: ECR basic scanning, on by default in many registries, or enhanced scanning, which is Inspector.
AWS's price: Basic scanning: USD 0 added.

Systems Manager

What it adds: The operating system package list of each managed instance, so that a version outside an advisory's range can be answered.
What you turn on: The SSM agent and the managed-instance permission. Default Host Management turns it on for the account.
AWS's price: EC2 instances: USD 0 added.

Inspector software export

What it adds: The list of components of each image and Lambda function that Inspector covers, for same-day package matches.
What you turn on: Inspector, and a signed change to the install's parameters. Optional.
AWS's price: Storage of the export, in cents a month.

Running images, Lambda, EKS, databases, machine images

What it adds: What runs: image digests, runtimes and layers, cluster and add-on versions, engine versions and AWS's pending security updates, end-of-support dates.
What you turn on: Nothing. These are control-plane reads that the watching identity makes already.
AWS's price: USD 0 added. If a cluster stays on extended support, AWS charges about USD 0.60 an hour against USD 0.10, and the console is to show that cost.