O3 Security Image Scanner
O3 Security Image Scanner checks container images for operating-system vulnerabilities, malicious layers, embedded secrets, and permission misconfigurations …
What O3 Security Image Scanner is
O3 Security Image Scanner checks container images for operating-system vulnerabilities, malicious layers, embedded secrets, and permission misconfigurations before registry push. It supports Docker, OCI, and distroless formats and inspects every layer for packages, application code, credentials, and changes. Malware checks compare new binaries with known-good hashes and look for malicious signatures, unexpected cron jobs, startup scripts, and obfuscated shell scripts. Secret detection can find API keys, database credentials, and private keys left in earlier layers after later deletion. Scans can run on push, on pull through a scanning proxy, or on a recurring schedule. Integrations include Amazon ECR, Google GCR and Artifact Registry, Azure ACR, Docker Hub, and private Docker Registry API v2 registries. Each scan creates CycloneDX and SPDX SBOM output. Findings include CVSS, exploitability, fix version, and introducing layer, and critical results can block production promotion. O3 lists more than 30 native integrations and offers self-hosted deployment in a customer VPC or air-gapped environment without outbound telemetry.
Good
- Inspects every image layer
- Detects secrets surviving in earlier layers
- Generates CycloneDX and SPDX SBOMs
- Can block promotion for critical findings
- Supports air-gapped self-hosting
Watch out
- Pricing is available on request
- Web platform only
- Self-hosted deployment requires customer infrastructure
Who it suits
It suits development and security teams that need container-image checks, SBOMs, registry controls, or self-hosted deployment.
Verdict
O3 combines layer-level image inspection, vulnerability intelligence, secret and malware checks, and registry controls. Its self-hosted and air-gapped options suit teams with strict deployment or telemetry requirements.
Plans and prices
From O3 Security Image Scanner's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Paid | Priced on request | Pricing on request |
The facts
Each one read from O3 Security Image Scanner's own pages, with the date it was checked.
What it does
- Data protection
- O3 states that data in transit uses TLS 1.3, data at rest uses AES-256, and production access is restricted, logged, and reviewed.checked 1 Oct 2026
- Deployment
- O3 states that it offers self-hosted deployment inside a customer VPC or air-gapped environment with no outbound telemetry required.checked 1 Oct 2026
- Image formats
- The scanner works with Docker, OCI, and distroless images.checked 1 Oct 2026
- Integrations
- O3 lists more than 30 native integrations across CI/CD, code editors, package managers, cloud, ticketing, and registries.checked 1 Oct 2026
- Layer inspection
- O3 decomposes and inspects every image layer, including OS packages, application code, credentials, and layer changes.checked 1 Oct 2026
- Malware detection
- O3 compares added binaries against known-good hashes and detects malicious signatures, unexpected cron jobs, startup scripts, and obfuscated shell scripts.checked 1 Oct 2026
- Promotion blocking
- The registry integration can block promotion to a production registry when critical findings are present.checked 1 Oct 2026
- Purpose
- O3 scans container images for OS vulnerabilities, malicious layers, embedded secrets, and misconfigured permissions before registry push.checked 1 Oct 2026
- Registry integrations
- The image scanner integrates with Amazon ECR, Google GCR and Artifact Registry, Azure ACR, Docker Hub, and private registries using Docker Registry API v2.checked 1 Oct 2026
- Registry scanning
- Images can be scanned on push, on pull through a scanning proxy, or on a recurring schedule.checked 1 Oct 2026
- SBOM output
- Each scan generates SBOM output in CycloneDX and SPDX formats.checked 1 Oct 2026
- Secret detection
- O3 detects secrets that remain in earlier layers even after later deletion, including API keys, database credentials, and private keys.checked 1 Oct 2026
- Security certifications
- O3 states that it is SOC 2 Type II and ISO 27001 certified, with audit reports available on request under NDA.checked 1 Oct 2026
- Vulnerability intelligence
- O3 matches packages against NVD, OSV, and distribution-specific advisories and reports CVSS, exploitability, fix version, and introducing layer.checked 1 Oct 2026
Alternatives to O3 Security Image Scanner
- 1
Mondoo CSPM
Free planOpen sourceWebAPIExtensionLinux7.7Free plan - 2
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 5
Trivy
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 6
ZeroPath
WebAPILinuxmacOS6.5From $1,000 a month