A security team wants to automatically assess their Amazon EC2 instances and container images for software vulnerabilities and unintended network exposure. They need a service that continuously scans workloads against known CVEs and produces prioritized findings. Which AWS service should they use?