Tools/AQUA
Aqua Security
Container image scanning — CVEs in base images/OS packages, misconfigurations, and (with runtime protection tiers) drift/behavioral detection once a container is running. Where Snyk's SCA covers application dependencies, Aqua covers the image layer underneath them — commonly both run in the same pipeline, gating the image build step in GitHub_Actions before a push to JFrog_Artifactory.