Vulnerabilities

What is in early access

The scanner is being built in slices. This list was read from the product's repository at commit 246a7f5712ee, so it says what exists there and not more.

The public advisory pages and the feed status page: On this site now. They show what the feed's copy on this site holds, and say so when it holds nothing.
The feed's file formats, signatures and verifier: Written and tested in the product. Heads, deltas, catch-ups and snapshots, two feed signatures, the release-signed delegation and the curator signatures. Tested against test keys.
The vendor's builder and co-signer: Written and tested in the product. Written and tested with stand-ins for the vendor's AWS accounts. It has not run against real accounts or real signing keys.
Readers for what runs: Written and tested in the product. Amazon Inspector, ECR, running images, Systems Manager, Lambda, EKS, managed databases and data services, Elastic Beanstalk and machine images, read-only.
Fetching the feed in an install: Not in the early access release. An early access install does not download the feed.
Matching, ranking and the Vulnerabilities page: Not in the early access release. An early access install shows no vulnerability findings.

The rest of this page describes the scanner as it is designed. Where it says what an install does, the list above says which parts of that are in the product today.

What it reads

Everything it is designed to read is a read-only call by the watching identity, which never writes. Warden installs no agent on a workload and sends no traffic to one.

It reads	It learns
Control-plane calls to AWS and the cluster, by the watching identity.	Which instances, images, functions, clusters and managed engines exist, and their versions.
Inspector findings and coverage, ECR scan results.	Package flaws a scanner found, and which resources a scanner covers.
Systems Manager inventory of three AWS types only.	Operating system packages of managed instances.

What it does not read

The design blocks most of these with an explicit IAM deny on the watching identity. Some are kept out by code alone, because IAM has no condition that could do it.

Image layers, manifests and image configurations.
ECS task definitions, which can hold environment values.
Lambda code and layer contents. The function listing's environment values are dropped on arrival.
Inspector code snippets and the contents of Systems Manager custom or file inventory.
Anything on a host. Warden installs no agent and sends no traffic to your workloads.

It says how much it could see

In the design, every running thing carries one of these states. A thing that could not be read is never called clear.

Packages: The operating system packages were read. It cannot see the libraries inside applications.
Software list: A software list exported from Inspector was read.
Scanner: Only a scanner's findings exist. Its silence counts only for advisories older than its last scan.
Versions: Platform, engine, runtime, kernel or node versions are known, not packages.
Declared: Only the identity of a curated official image is known.
None: Nothing could be read, with the reason and what turning it on would cost. It is never reported as clear.

The advisory feed

New advisories come from a feed the vendor builds from the public databases and from items a curator writes after reading security mailing lists and project announcements, often before a CVE number exists. Each install is designed to download the same public files as every other install and to match them against an inventory it already holds. A new advisory needs no new read of your estate.

Each head of the feed carries two signatures made by keys in separate custody. The keys are named by a delegation that the release keys sign, and the delegation is renewed every three weeks. A lapsed delegation stops an install accepting new heads, and it says why.
A curated item carries a third signature, by a curator key from the release root. Machine sources run around the clock. Curation is by one person in working hours, and the feed status page publishes the measured time from a source's post to the feed. The site makes no response-time promise.
An install is designed to fetch by fixed path, with a fixed user agent that carries no version, no cookie and no query string, over a fresh connection each time, to read this site's copy first and the vendor's bucket second, and to compare the two heads.
An install is designed to keep only verified files and, if the vendor is down, to keep matching on what it has and say how old that is.

What each host can see

Cloudflare, which serves this site's copy, sees the address of each request and its time. Cloudflare's own analytics keep that per request.
AWS, which serves the vendor's bucket as the second source, sees the same for requests to it.
This site counts nothing on /feed/ and writes no log line for it. The vendor's bucket is defined in its template with no access log and no record of reads, so the vendor stores nothing about fetches.
An install's fetch is designed to run outside any VPC, so its requests come from the AWS region's shared Lambda address pool, and to let a keeper who wants less choose an hourly or daily fetch, or a fetch only on request.

The curated items and the known-exploited additions the product recognises are public at /advisories, each with its identifier, typed facts and a link to the public page for that identifier.

How ranking by reach works

In the design, code decides every rank, from typed facts. No model output raises or lowers one. The facts are these.

Exploited: Seen on this resource after the vulnerable version started running; listed as exploited in the wild; or a public exploit or a high exploit-prediction score exists.
Exposure: A proven path from the internet to the workload. When the estate graph is incomplete the page says it could not tell, and why.
Power: Whether the workload's identity reaches administrator rights or a data store, or the pod is privileged.
Impact: Takeover, partial or unknown, from the feed, never guessed.
Running: Running now, deployed but stopped, or only in a registry.

The first row that holds wins. A flaw on a batch job that can read one bucket ranks below a lesser flaw on an internet-facing pod whose role can become administrator, and each item says why in one sentence built from those facts.

Band	When
Fix now	Exploitation is seen on the resource itself; or a flaw on CISA's known-exploited list (or a curator's signed statement that it is being exploited) runs on something reachable from the internet or on a workload whose identity can reach administrator rights; or a malicious package is confirmed by its artefact.
This week	A flaw on the known-exploited list is running anywhere; a public exploit exists for a takeover flaw on an exposed or powerful workload; or a platform is past its end of support with no security fixes and is exposed.
Plan	A public exploit exists, or a takeover flaw is exposed; end of support within 90 days; an AWS security update is waiting; or the software is not running.
Long tail	Everything else.

Matches are grouped by the change that fixes them, such as moving a deployment to a newer image tag, so the few at the top are actions. Confidence lowers a band when a match rests on an image name alone or on an upstream advisory for a distribution package.

What to enable in AWS, and what it costs

With no option turned on, the scanner is designed to know platform, engine, runtime, node and image versions, AWS's pending updates and end-of-support dates. The options below add package-level depth. None is required, and Warden turns none of them on. The console is to explain each with AWS's own instructions. Each price is AWS's list price for the option, which AWS bills to your account: AWS list prices in us-east-1, checked on 23 October 2026.

Amazon Inspector

What it adds: Package-level flaws on instances without Systems Manager, inside container images and inside Lambda packages, with the fixed version.
What you turn on: Inspector, per resource type and region.
AWS's price: About USD 1.26 per EC2 instance a month. Images: about USD 0.09 for the first scan, USD 0.01 per rescan. Lambda: about USD 0.30 per function a month, and about USD 0.60 more with code scanning, USD 0.90 together.

ECR scanning

What it adds: Operating system package flaws in images pushed to ECR, when Inspector is off.
What you turn on: ECR basic scanning, on by default in many registries, or enhanced scanning, which is Inspector.
AWS's price: Basic scanning: USD 0 added.

Systems Manager

What it adds: The operating system package list of each managed instance, so that a version outside an advisory's range can be answered.
What you turn on: The SSM agent and the managed-instance permission. Default Host Management turns it on for the account.
AWS's price: EC2 instances: USD 0 added.

Inspector software export

What it adds: The list of components of each image and Lambda function that Inspector covers, for same-day package matches.
What you turn on: Inspector, and a signed change to the install's parameters. Optional.
AWS's price: Storage of the export, in cents a month.

Running images, Lambda, EKS, databases, machine images

What it adds: What runs: image digests, runtimes and layers, cluster and add-on versions, engine versions and AWS's pending security updates, end-of-support dates.
What you turn on: Nothing. These are control-plane reads that the watching identity makes already.
AWS's price: USD 0 added. If a cluster stays on extended support, AWS charges about USD 0.60 an hour against USD 0.10, and the console is to show that cost.

These are AWS list prices in us-east-1 as read on 23 October 2026. AWS sets and changes them, so check AWS's price list before turning anything on.