Why scanner output is not authoritative: The case for managing assumptions in vulnerability management

Summary

This article argues that vulnerability management programs are fundamentally flawed because they treat scanner output as authoritative truth. The author demonstrates through a real experiment that two industry-standard scanners (Grype and Trivy) produced an 80.5% divergence in CVE counts on the same Red Hat 8 container image. The core thesis is that security teams should stop managing vulnerabilities and instead manage scanner assumptions — understanding what each scanner looks for, how it interprets data, and where its blind spots are. The article calls for a shift from treating scanners as definitive sources to treating them as imperfect tools whose outputs must be contextualized and cross-referenced.