Trivy as MSP CI gate: scan, prioritize, fail closed

Trivy (Aqua Security) is widely used as a CI/CD scanner for CVE, misconfig, secrets, and SBOM generation. For MSP fleets, the useful pattern is: scan on every pipeline → prioritize by severity/exposure → fail closed on critical policy breaches before admit/deploy. No exploit or PoC content in this draft.

Trivy as MSP CI gate: scan, prioritize, fail closed

SBOM + fail policy: Emit SBOM artifacts as build evidence; map critical/high findings to ticket owners; block promote when policy says fail-on-critical (or your agreed severity floor). Scanning attests known issues in the artifact — it does not replace signing, admission controls, or runtime detection.

Where MSPs already store pipeline evidence, keeping the SBOM next to it is a natural hygiene step.