Question

A financial services company has repeatedly discovered critical security vulnerabilities in container images only after they were deployed to production, forcing emergency rollbacks and eroding stakeholder confidence. The architecture team wants to embed security checks earlier in the software development lifecycle so that vulnerable code and images are caught before they reach production, without significantly slowing developer velocity. Which approach best addresses this goal?

Accepted Answer

Integrate automated vulnerability scanning of dependencies and container images into the CI pipeline, failing the build when critical vulnerabilities are detected before artifacts are promoted.

Answer

Schedule a weekly manual penetration test of the production environment and file remediation tickets for the development team to address in the next sprint.

Answer

Enable Security Command Center to continuously scan running production workloads and alert the operations team when critical findings appear.

Answer

Require a security architect to manually review every pull request and sign off before any merge to the main branch is permitted.