The Five Stages of AVR
Scan and Detect
When a new CVE is published, Root’s system ingests the vulnerability data within seconds — NVD advisories, upstream commit history, exploit databases, affected version ranges. Affected components are identified automatically, and remediation is triggered without any human intervention.
Build a Remediation Plan
Research agents analyze the vulnerability in depth: locating upstream fixes, assessing compatibility with the specific versions you’re running, and determining whether a backport or native distribution package upgrade is the right approach. This stage produces a precise remediation strategy before any code is changed.
Apply the Fix
Patching agents generate the fix for the exact version you’re running. Root patches existing software rather than rebuilding from source. If an upstream fix exists, it’s backported to your pinned version. This preserves compatibility — your dependencies don’t change, only the vulnerability is removed.
Test and Validate
The patched artifact is validated against multiple layers of testing: the package’s own test suite, functional tests, CVE-specific regression tests that confirm the exploit is blocked, and compatibility verification that confirms nothing else broke. A patch doesn’t ship until it passes.
AVR vs. Rebuilding from Source
Other secure image providers rebuild entire images from source. This creates breaking changes, forces migrations to vendor registries, and limits version support. Root’s approach is different:| Rebuild Approach | Root AVR | |
|---|---|---|
| Method | Rebuild entire image from upstream source | Patch in place |
| Breaking changes | Possible | None |
| Registry migration | Required | Not required |
| Version support | Limited to maintained versions | Any version |
| User control | Reduced — tied to vendor’s build | Full — you validate and implement |
Why AVR Scales
Manual CVE remediation is a per-ticket, per-engineer process. AVR handles hundreds of vulnerabilities daily across every subscribed artifact, operating continuously without fatigue or backlog. When a CVE is published, remediation starts within seconds — not after a standup.Trust and Verifiability
AVR is built to be audited, not just trusted:- Transparency — every patched artifact documents what was fixed and how
- Verifiability — Patch Explorer lets security teams review the full remediation for any artifact
- Testing — fixes are validated before delivery; test results are included in the artifact’s provenance
- Cryptographic attestation — SBOM, VEX, and provenance prove the artifact came from Root’s pipeline