OpenAna + Anchore & Grype

Image vulnerabilities and policy results from Anchore Engine, Anchore Enterprise, anchorectl and Grype.

Report importSecurity testing

Ana + Anchore & Grype

What Ana does with it.

Findings Ana pulls live or imports, de-duplicates, ranks by real exposure and turns into fixes.

01
SBOM-backed image vulnerability analysis
02
Upgrades that resolve the most findings per change
03
Policy results tracked to closure

Setup

Connected in four steps.

1
Export or schedule
Export results from Anchore & Grype in its standard report format, or schedule the export.
2
Import
Upload to Ana or drop into the connected storage; Ana parses and normalizes every finding.
3
Merge
Findings are de-duplicated with your other scanners and ranked by real exposure.
4
Fix and prove
Ana opens fixes with regression tests and keeps closure evidence per finding.

In practice

Playbooks that use Anchore & Grype.

Security

Clearing a dependency CVE backlog

Your SCA tool reports thousands of vulnerable dependencies and the number never goes down. Ana works out which are actually reachable, upgrades them safely with tests, and documents why the rest can wait.

Read the playbook →

Embedded

Patching a firmware CVE and shipping it over the air

A vulnerability lands in a component your devices ship. Ana finds every affected firmware build from the SBOM, patches and tests it, and stages an OTA rollout that stops itself if devices misbehave.

Read the playbook →

Used by

Ana’s engineers

Security →Embedded →

Governed

Every action, approved and logged.

Ana’s guardrails decide what it may do with Anchore & Grype, route sensitive actions to named approvers, and keep evidence for each decision. OpenAna is SOC 2 Type II, ISO 27001, HIPAA and GDPR compliant.

Guardrails →Trust center →

FAQ