Integrate Amazon Inspector with Vulnetix. Export vulnerability findings and SBOMs from Amazon Inspector via the AWS CLI or SBOM export feature for upload to Vulnetix.
Run Amazon Inspector in CI
Scan on every push and upload the report as a workflow artifact:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::ACCOUNT:role/InspectorRead
aws-region: us-east-1
- name: Export Inspector SBOM
run: |
EXPORT_ID=$(aws inspector2 create-sbom-export --resource-filter-criteria '{}' --report-format CYCLONEDX_1_4 --s3-destination "{"bucketName":"$BUCKET","keyPrefix":"sboms/"}" --query 'reportId' --output text)
echo "Export started: $EXPORT_ID"
How Vulnetix compares: better together
Vulnetix does not replace Amazon Inspector. Keep running it. Vulnetix sits on top of Amazon Inspector (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Amazon Inspector is strongest at its core category and also carries features in Container & Image Scanning, Network & Vulnerability Scanners, SAST, IaC & Cloud Configuration, SBOM Generation, just as Vulnetix spans categories.
| Capability | Vulnetix | Amazon Inspector |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ~ Code scanning of application source via GitHub/GitLab integration and Lambda code (CodeGuru detector library) |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Continuous OS-package and application-dependency vuln scanning across EC2, ECR images and Lambda |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✓ Scans ECR container images and images in CI/CD pipelines |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ~ IaC scanning offered through the source-code integration |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✓ Exports CycloneDX 1.4 and SPDX 2.3 SBOMs to S3 for all monitored resources |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✓ Detects unintended network exposure via reachability analysis of AWS resources |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ Risk score folds in exploitability data, reachability and social-media trends, but not explicit EPSS/CISA KEV/ESS feeds |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Amazon Inspector does well
- Fully-managed, zero-config continuous scanning that auto-rescans EC2/ECR/Lambda whenever a package changes or a new CVE lands
- Network reachability analysis that models AWS topology to flag unintended internet exposure and down-weight unreachable CVEs
- Environment-tailored Inspector risk score correlating CVE data with network reachability, exploitability and social-media trends
- Deep native AWS integration (ECR, Lambda code, GitHub/GitLab code + IaC, Security Hub, EventBridge) plus CycloneDX/SPDX SBOM export
Where Vulnetix adds to it: Inspector is best-in-class for AWS-resident workloads; Vulnetix ingests its findings and CycloneDX SBOMs and unifies them with non-AWS scanners into one deduped, exploit-prioritised queue (EPSS, CISA KEV, LEV), adding reachability, immutable versioned VEX, EOL/SSVC policy and Safe Harbour autofix across clouds. It does not replace Inspector's AWS-native scanning.
No migration, no rip-and-replace. Amazon Inspector keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Amazon Inspector results in Vulnetix
Upload Amazon Inspector CycloneDX, SPDX, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.