Aikido now scans Docker Hardened Images (DHI) with built-in VEX support.Vulnerabilities that Docker has verified as non-exploitable drop out of the queue automatically, so developers spend their time on findings that actually matter.This post walks through what changed, why it matters, and how users can benefit from the new integration.

Why teams are drowning in CVEs

Modern application teams drown in CVEs.And the volume is climbing fast.AI coding agents now generate and assemble software far faster than any team can

Just published by Docker: Read more

Understanding software supply chain security is one thing.Putting it into practice across a real pipeline, with real deadlines and real constraints, is another.Most organizations recognize that their software supply chain is a growing attack surface, but translating that awareness into concrete, repeatable practices is where the work gets difficult. But why should your team tackle this now?According to Sonatype, over 99% of open source malware identified in 2025 occurred on npm.And the first self-replicating npm worm emerged, spreading autonomously across

Just published by Docker: Read more

AI agents are moving fast.According to our State of Agentic AI report, 60% of organizations already have AI agents in production, yet 40% cite security and compliance as the number-one barrier to scaling them further.And that gap between adoption and oversight is exactly where AI governance lives. As AI takes on higher-stakes decisions and agents begin operating with greater autonomy, the organizations that lack clear guardrails face mounting exposure to regulatory penalties, security vulnerabilities, and reputational damage.AI governance closes that gap

Just published by Docker: Read more

When security teams scan their container environments for the first time, they often discover hundreds of known vulnerabilities, and almost none of them trace back to application code. The overwhelming majority come from packages that shipped with the base image:shells, compilers, debug utilities, and libraries the application never calls.In a software supply chain built on containers, the base image is the foundation.If that foundation ships with unnecessary components, every workload built on top of it inherits the risk. Hardened images address this problem

Just published by Docker: Read more

Software supply chain attacks have accelerated faster than most security teams anticipated.Sonatype’s 2026 State of the Software Supply Chain report identified more than 454,000 new malicious packages published to open source repositories in 2025, bringing the cumulative total to over 1.2 million since 2019.The blast radius keeps expanding as organizations consume more open source software, ship more container-based workloads, and distribute software through increasingly complex pipelines. Software supply chain security is the discipline of protecting every component, process, and system involved

Just published by Docker: Read more