What a platform team actually buys from a hardened-image vendor is a rebuild queue. The artifact sitting in the registry is the receipt. The working promise is that somebody else notices a fix landing upstream on a Saturday, rebuilds, re-signs, and publishes a new digest before Monday's scan runs.
That promise gets stricter the more the image is stripped. Pull out the package managers, the shells and the compilers, as Minimus's catalog did to cut attack surface [4], and nobody downstream can patch the thing from the inside: there is no shell to run and no package manager to run in it. The absence is the security benefit and the supplier dependency in the same design decision.
Teams take that trade for defensible reasons. Black Duck's 2026 report found 87 percent of audited commercial codebases carried at least one open-source vulnerability, at an average of 581 per codebase [11], and 65 percent of surveyed organisations reported a software supply-chain attack in the previous year [12]. Paying someone to own the base layer is cheaper than staffing it.
The part that is not on the pricing page is what happens to the evidence. Echo ships its images with SBOMs, signatures and attestations [3], and artifacts like those tend to get wired into an admission controller and into the folder handed to an auditor. When a publisher stops publishing, the containers keep running and the evidence quietly stops refreshing. That is a slower failure than an outage and harder to notice.
Now the size of the thing standing behind the base layer. Echo raised a $35 million Series A in December, led by N47 [9]. IBM put the 2026 global average cost of a breach at $4.99 million [13]. Divide one by the other and the entire round is worth about seven average breaches [14]. That is not a knock on Echo, whose chief executive Eilon Elhadad said the firm moved once it was clear Minimus would close so the work would not disappear [5]. It is the arithmetic of the category: Minimus was founded in 2022 and wound down this year, roughly four years of operating history [15]. Chainguard sells hardened images and repository scanning into the same market [10], which means the plausible buyer of a failing catalog is a firm you were price-comparing against last year.
So the forcing function, two questions per image family. Could we rebuild this from upstream inside one sprint? Is our admission policy pinned to exactly one publisher's key? Two noes is a normal Tuesday. Rebuildable but pinned is the quadrant where you add a second accepted signer while it is still a chore rather than an incident. Unique and pinned is the one that needs a written number: how many days the last-good digest can stay in production before your own compliance window closes.
The metric to track is patch latency, meaning days from upstream fix to vendor digest, alongside the count of images with no second source. Catalog size is the vendor's number, and it tells you nothing about who rebuilds on Saturday.
