Base image CVEs are findings in packages the application team never chose and often cannot read, which makes them both the most expensive to triage and the cheapest to remove [10]. Swapping a base image is one line in a manifest. Fixing the same CVEs in place means a developer reading upstream changelogs for software nobody on the team owns. On triage economics alone, image selection is the first lever, and Wiz's recommendation to standardize on hardened components follows from that [11].
It is also a bounded one. Wiz research puts base images at 39 percent of critical and high severity CVE findings on production containers [1]. Subtract that from the whole and 61 percent of those findings sit elsewhere [1]: application dependencies, runtimes the build pulls in, and first-party code. No base image reaches them.
The post attributes the 39 percent to "Wiz research" without stating a sample, a timeframe, or the rule used to assign a finding to the base layer rather than the application layer [14]. The benchmark carries the same caveat. The 94 percent median CVE reduction is Wiz testing Wiz images against variants it selected as equivalent [3], and the same test reports 48 percent average cuts in image size and in package count [4][5].
Package count is the number worth banking. A component that is not installed cannot carry the next disclosure at all, whatever the response window looks like. The CVE figure is a count of findings, and the post does not break out how many of the removed CVEs were reachable at runtime, which is the number that would say what the swap buys in exposure rather than in dashboard rows.
On provenance, Wiz says WizOS images are built directly from source in a hardened pipeline with no internet connectivity [8], rebuilt daily, and signed with verifiable cryptographic provenance [7]. That is a hedge against the pattern Wiz cites from the past year, in which attackers compromised CI/CD systems such as GitHub Actions to inject malware into open source components [12]. Signing establishes where a build came from. It says nothing about whether the source it was built from was clean.
Priced on triage economics, image selection is worth doing whether or not the 39 percent survives publication of its method. It leaves the larger share of critical and high findings exactly where it was, owned by the team that wrote the code.
