The default Secure policy pack comes included (and enabled) in every fresh deployment of Anchore Enterprise.
Current Secure policy pack version: Anchore Enterprise - Secure v20260101
Introduction
Anchore Enterprise’s default Secure policy pack includes standard vulnerability checks and can be used against an image or SBOM for policy compliance based on the policy actions configured in each rule. All the rules that are configured by default can (and should) be adjusted according to an organization’s security policy.
Anchore Enterprise checks for the following control specifications in the Secure policy:
- Feed Data not available Fail when vulnerability feed data is unavailable (container images only)
- Outdated Feed Data Warn when the vulnerability feed data is stale (container images only)
- Warn on low, moderate, and high with fixes Warn when there are low, medium, or high severity vulnerabilities found that also have a fix present
- Warn on week old Important Warn when there are important severity vulnerabilities found that are more than a week old “Important” indicates the severity of a vulnerability. By default, it is set to “High” but this can be configured in the policy rule set
- Fail on criticals Fail when there are critical severity vulnerabilities present
- Fail on KEV list Fail when there are vulnerabilities present that appear on the CISA Known Exploited Vulnerabilities (KEV) catalog
The pack ships parallel rule sets for container images and SBOMs, so the vulnerability checks apply whether you scan an image or import an SBOM directly. The two feed-data checks are the exception: they are bound to the container mapping only and are not evaluated against SBOMs.