Skip to main content

How to scan VM images

Virtual machine (VM) images are software packages that typically contain an operating system together with installed software, configuration, and other files required to run a virtual machine. Unlike many other package types, a VM image represents an entire machine rather than a single application or archive.

VM images are distributed in a variety of formats and may contain multiple partitions and file systems. Before analysis begins, Spectra Assure identifies the image format and applies the processing needed to expose the contents of the image for analysis. Supported formats are listed on the Community and language coverage page.

When working with a VM running in a cloud environment, it needs to be exported before scanning.

Why VM images require additional processing​

Unlike archives or installer packages, VM images cannot be analyzed by simply reading their contents. Before security analysis can begin, Spectra Assure identifies the supported partitions and file systems within the image, exposes their contents, and enumerates the files they contain.

This allows the same security analysis used for other package types to be applied without booting or deploying the virtual machine, helping identify security issues before the image is introduced into an environment.

What Spectra Assure examines​

For most package types, Spectra Assure analyzes the files and components contained within a package. For VM images, the package represents an entire file system, which Spectra Assure first processes before analyzing its contents.

Depending on the image, Spectra Assure may analyze:

  • operating system files
  • installed software packages
  • executable files
  • libraries
  • archives and nested packages
  • scripts
  • configuration files
  • package metadata
  • other files stored within the image

Spectra Assure focuses on identifying security risks within the VM image. It does not verify that the virtual machine boots or functions properly.

If a VM image contains encrypted file systems or partitions, Spectra Assure cannot analyze their contents. As a result, files stored within encrypted areas are not included in the analysis, and any security risks they contain will not be reflected in the results.

How VM images are processed​

Like every supported package type, VM images follow the same overall scanning workflow. The difference lies in how the package is processed before analysis.

For VM images, Spectra Assure:

  1. Identifies the image format, so the appropriate processing workflow can be applied.
  2. Processes the disk image, exposing supported partitions and file systems for analysis without booting or deploying the virtual machine.
  3. Enumerates the file system, identifying files, directories, installed software, archives, and other components throughout the file system. Supported archives and packages are recursively processed so their contents can also be analyzed.
  4. Analyzes the contents, examining each discovered file and component for malware, tampering, vulnerabilities, embedded secrets, and behaviors associated with malicious or unsafe activity.
  5. Classifies the findings by severity and risk, helping teams prioritize remediation.

This workflow allows VM images to be analyzed before they are deployed into development, test, or production environments.

When and why to scan VM images​

Even though a VM image is distributed as a single package, it should be treated as a complete software environment containing an operating system, installed software, and system configuration.

VM images should be scanned before they are deployed or introduced into an environment, regardless of whether they originate from an internal repository or a third-party source.

Typical points for scanning include:

  • before importing third-party VM images
  • before publishing internally built images
  • as part of CI/CD pipelines
  • before deploying virtual machines
  • before releasing software that includes VM images

Scanning before deployment provides several benefits:

  • Detection before deployment. Malware, tampering, embedded secrets, and vulnerabilities can be identified before the image is deployed.
  • Reduced supply chain risk. Third-party images can be validated before they are introduced into an environment.
  • Earlier remediation. Identifying security issues before deployment is significantly less disruptive than addressing them after an image has been deployed.
  • Automated workflows. VM image scanning can be integrated into CI/CD pipelines alongside scans for other supported package types.
  • Better visibility. The generated xBOM provides an inventory of the software components identified within the VM image.

Exporting VM images from cloud providers​

Virtual machines running in cloud environments cannot typically be scanned directly. Instead, they should first be exported to a supported VM image format and then scanned as a software package.

Most cloud providers offer a way to export virtual machine images for offline analysis. For example, AWS supports this through the VM Import/Export feature.

After exporting the image, ensure the output format is one of the supported VM image formats, then scan it with Spectra Assure.