After the initial scan completes, scan re-evaluation keeps container image findings up to date without requiring the image to be re-pulled or re-scanned.
Because container images are immutable, the software inventory and scan results from the initial scan are retained and reassessed as new information becomes available.
Scan re-evaluation occurs in the following scenarios:
* **New vulnerability intelligence:** When updated vulnerability intelligence becomes available, the stored software inventory of previously scanned images is matched against the updated data, and associated findings and risk scores are updated.
* **Base image changes:** When the base image used to build an image changes, affected images are reassessed to reflect the updated layer information.
* **Updated malware verdicts:** File verdicts for previously scanned images are periodically rechecked. If a file is later classified as malicious, a new finding is generated.
Scan re-evaluation applies to **vulnerability and malware findings**. Secrets and compliance findings are determined during the image scan and are updated only when the image is rescanned, such as after a scanner engine update.
Scan re-evaluation reduces resource-intensive rescans while keeping security assessments current and helping you identify and mitigate emerging risks in images stored in your registries.