One image scan doesn't see your whole cluster.

The same Trivy binary has a second mode: point it at a live cluster instead of one artifact, and it enumerates every running workload itself.

Per-image scanning (previous slide)

One artifact

You already need to know which image to check — trivy image checkout:1.4. A real cluster runs dozens of images across a dozen namespaces; nobody has that list memorized.

Whole-cluster scanning

Live inventory

Trivy talks to the API server itself, finds every running workload, RBAC object, and Secret/ConfigMap — no pre-built list required.

terminal

# one command, four scanner types, the whole cluster
trivy k8s cluster --report summary
#  → image vulnerabilities   (the CVEs from the last slide, per running pod)
#  → misconfigurations        (no securityContext, running as root)
#  → RBAC assessment          (an over-broad ClusterRoleBinding)
#  → exposed secrets          (a key-shaped value sitting in a ConfigMap)

Answering "does anything running right now have a critical CVE, a dangerous RBAC binding, or an exposed secret" by hand across 40+ workloads means dozens of separate commands — this is one.