Base Image Currency
How far behind the fleet's running images are from their patched base, which is the number that decides how fast a critical vulnerability can be closed.
When a critical vulnerability lands in a base image, the time to remediate the fleet is the time to rebuild and redeploy every image derived from it. If images are rebuilt only when their application changes, a service that has not shipped for four months has a four-month-old base and will not be patched until someone touches it.
Currency is therefore a property of build cadence, not of scanning. Scanning tells you the fleet is vulnerable; only a scheduled rebuild-and-redeploy of every image against the current base actually fixes it. Organisations that can do this in hours have automated nightly rebuilds and enough deployment confidence to ship the result; those that cannot are negotiating with forty teams.
Two supporting decisions help. A small number of curated base images — ideally distroless or minimal — reduces both the vulnerability surface and the rebuild matrix. And pinning base images by digest rather than by tag makes the currency measurable at all, since a floating tag hides which base a given image actually contains.