Organisations invest heavily in protecting the network and the applications, but they often neglect the base image everything boots from. An AMI with outdated packages or unencrypted snapshots spreads risk to every instance born from it. The good news: protecting the image is a single, highly cost-effective control point.
The triad that solves it is simple to state and demanding to maintain: encryption, patching and demonstrable compliance.
1. Encryption: protecting data at rest and in transit
Encryption is the line of defence when everything else fails. For machine images it works at several levels:
- Encrypted EBS snapshots with AWS KMS, or Azure Disk Encryption and Google CMEK on other clouds.
- Customer-managed keys (CMK) with automatic rotation and minimal access policies.
- Encryption by default enabled at the account level so no image is ever born unencrypted.
- Secrets managed outside the image: never bake passwords or tokens; inject them at runtime with Secrets Manager, Vault or Parameter Store.
2. Patching: the race against CVEs
Vulnerabilities are published every day. An image is secure the day you create it, and a little less every day after that. Patch management in an immutable world is not about updating live servers, but about rebaking frequently.
- Rebuild cadence: rebuild the base image at least monthly, and urgently on a critical CVE affecting your stack.
- Scanning in the pipeline: integrate Trivy, Grype or Amazon Inspector to catch CVEs before publishing.
- Quality gate: block publication if vulnerabilities appear above a threshold, for instance critical or exploitable high ones.
- SBOM: generate a Software Bill of Materials to know exactly what each image contains and respond quickly when the next Log4Shell lands.
3. Compliance: prove it, do not just do it
In an audit, being secure is not enough: you have to prove it with evidence. Well-governed images produce that evidence naturally.
| Framework | What it expects from your images | Evidence you can provide |
|---|---|---|
| SOC 2 | Consistent, monitored security controls | Hardening reports and build logs |
| ISO 27001 | Vulnerability management and change control | CVE scans, versioning and SBOM |
| PCI DSS | Secure configuration and documented patching | CIS Benchmark and rebuild history |
| ENS / GDPR | Encryption and data minimisation | KMS encryption and no personal data in the image |
How secure image practices translate into compliance evidence.
The new regulatory context of 2026
The regulatory environment is tightening. In 2026 key stages of the European AI regulation and new product liability directives come into force, and several jurisdictions are strengthening their cloud governance and compliance requirements. The practical translation: traceability of what software you run and how you secure it stops being optional. An auditable image chain is your best insurance.
Image security checklist
- Encryption by default enabled and snapshots with a CMK.
- No baked-in secrets; external credential management.
- CVE scanning on every build with a quality gate.
- Periodic rebuilds and rebuilds on critical CVEs.
- CIS Benchmark applied and validated.
- SBOM and build logs archived as evidence.
- Safe retirement of obsolete images.
Frequently asked questions
How often should an immutable image be patched?
It is not hot patched: it is rebuilt. A monthly cycle is a good minimum, with extraordinary rebuilds on critical CVEs affecting your software.
What is an SBOM and why do I need one?
An SBOM is the inventory of all the software and dependencies in your image. It lets you know in minutes whether a new vulnerability affects you, and it is increasingly required for compliance.
Does encryption affect performance?
EBS encryption with KMS is transparent and its performance impact is practically imperceptible for most workloads.
At imaxe.cloud we apply encryption, scanning and continuous updates to our images so you start from a base you can defend in any audit.
