Registry-native scanning is container image inspection performed inside the registry, where images are stored, tagged, and promoted before deployment. Instead of waiting for a CI job or a running workload, the scanner evaluates the artifact at rest, usually checking manifests, layers, package metadata, and sometimes attached SBOM data.
This matters because the registry is a control point in the supply chain. Security teams can block promotion of images with known vulnerabilities, misconfigurations, or suspicious content before those images reach clusters. In defense, registry-native scanners are often used with policy gates, quarantine rules, and repeated rescans when new CVEs appear. In attacks, a poisoned base image or a compromised build output may be caught if the registry is configured to inspect every pushed artifact. The tradeoff is that registry scanning sees stored artifacts, not runtime behavior, so it works best alongside build-time and runtime controls.