Docker pull python:3.x feels like you asked for Python. What you actually got was ~430 packages: a shell, two package managers, a C compiler, and a few hundred known CVEs - an entire distro userland your app will never use, but an attacker with RCE absolutely will.
Docker pull python:3.x feels like you asked for Python. What you actually got was ~430 packages: a shell, two package managers, a C compiler, and a few hundred known CVEs - an entire distro userland your app will never use, but an attacker with RCE absolutely will. In this session we’ll dissect a stock base image live using open tools (syft, grype, trivy), count exactly what an attacker gets for free, then rebuild the same app on a minimal/distroless base and measure the difference: 20x fewer packages, near-zero findings, no living-off-the-land toolkit. Along the way we’ll map the result onto the frameworks Australian teams answer to the ISM’s hardening controls, the Essential Eight’s 48-hour patch clock, PSPF 2026’s zero-trust push, and what an IRAP assessor actually asks about your scanner output. Less to attack, less to patch, less to explain.
Scott Norris is a Principal Solutions Architect at Chainguard, working with government and defence organisations across Australia and New Zealand. With over 20 years in enterprise IT, he has spent the last several of them focused on software supply chain security: helping organisations understand what is actually in the software they run, cut CVE remediation from a constant drain to a background task, and prove provenance for the code moving through their build pipelines.
His background is in large-scale multi-cloud governance, automation and DevSecOps, which shapes how he approaches supply chain problems now. Securing the software estate is not a scanning exercise bolted on at the end, it is a design decision made at the point the artefact is built. Scott calls this Secure-By-Construction, bringing together secure by design, secure by default and defence in depth into a single practical approach.
He works closely with teams navigating the Essential Eight, the SOCI Act and CIRMP obligations, IRAP assessment and the ASD ISM, translating those requirements into changes engineering teams can actually make.
