Standalone Binary Scanning

Overview

Standalone binary scanning identifies vulnerabilities in executables that no package manager installed, and that are therefore absent from the Software Bill of Materials (SBOM). A standalone binary arrives in an image or on a host through a build step that copies it in or compiles it from source. Redis, fluent-bit, and ingress controllers in distroless or scratch images are common examples.

This is not binary scanning in general. Sysdig has always analyzed the binaries that a package manager delivers, and it reads the build metadata that Go embeds in Go binaries. The word standalone refers only to executables that no package owns.

What Sysdig Reports

The scanner examines every executable on the asset and puts each one into one of three groups:

Identification and vulnerability coverage are two separate things. Sysdig can name a standalone binary and still report no vulnerabilities for it, because a component needs vulnerability data before it can produce findings.

An Application component also carries an application type, which describes what the software does. The types are Backup And Data Recovery Software, Database, Miscellaneous, Observability And Monitoring Software, Security, Software Runtime, Utility Tool, Web Browser, and Web Server.

Report Unidentified Executables

By default, the CLI Scanner reports only the executables it identifies. Pass --detect-unknown-executables to also report every native executable it does not recognize, each with its path and hash. Use this option to inventory what is on an asset. It does not add vulnerability findings.

Covered Binaries

Sysdig identifies a curated set of applications and matches vulnerabilities against them. Sysdig adds applications to this set in each release, so an application absent today can be covered in a later version.

The set currently covers the following applications:

• Apache HTTP Server
• ArangoDB
• AWS-LC
• Bash
• BusyBox
• Cabal
• Claude Code
• Codex
• Consul
• curl
• Dart
• Deno
• Elixir
• Envoy
• Erlang/OTP
• FFmpeg
• Fluent Bit
• GCC
• GHC
• Google Chrome
• GraalVM
• Grafana
• gzip
• HAProxy
• Helm
• IBM Java
• JDK
• jq
• JRE
• Julia
• Kong Kubernetes Ingress Controller
• Kong Operator
• Lighttpd
• MariaDB
• Memcached
• MongoDB
• MySQL
• MySQL Cluster
• MySQL Server
• Nginx
• Nginx Ingress Controller
• Node
• OpenJDK
• OpenLDAP
• OpenSSL
• Percona Server
• Percona XtraBackup
• Percona XtraDB Cluster
• Perl
• Pilot Agent
• Pilot Discovery
• PostgreSQL
• ProFTPD
• PyPy
• Python
• QtBase
• Redis
• Ruby
• Rust
• SQLCipher
• Stack
• SWI-Prolog
• Traefik
• util-linux
• Valkey
• Vault
• xz
• Zstd
• Zulu

Supported Environments

Sysdig adds support for standalone binary scanning one scanner at a time. The following table lists the current state of each scanner:

SaaS users get the feature first. The following table lists the state of each deployment type:

Limitations

• Sysdig reports vulnerabilities only for the applications in the covered set. An executable outside that set appears with its path and hash, and Sysdig reports no vulnerabilities for it.
• Sysdig does not decompile a binary or inspect its logic.
• You cannot filter components by the File category. The component category filter offers Application, Image, OS, and Package.
• Sysdig does not report license data or end-of-life data for a standalone binary. Both apply to OS packages and application libraries only.
• Standalone binary scanning finds vulnerable software. It does not detect malware.

Related Content

Two vulnerability policy rules govern which binaries an image or a host can carry. The Binary Allow List rule fails an asset that carries a binary outside your approved list. The Binary Deny List rule fails an asset that carries a binary you blocked. Both rules match on the name, the path, or the hash of the binary.

• Vulnerability, Image Configuration and Content Rules
• Malware Control Policy