Every container scanner spits out CVE lists long enough to kill a sprint. Docker and Black Duck think they have a fix: let the image publisher tell your scanner which vulnerabilities do not actually matter.
I read through the April 14 BDBA release notes. When BDBA scans a container, it fingerprints the base layer. If that layer is a Docker Hardened Image (DHI), BDBA pulls the VEX statement Docker already attached and auto-suppresses any vulnerability marked not_affected. No manual tagging, no policy edits. Black Duck can then enforce a global policy: ignore everything the image publisher already vetted.
What VEX actually does
VEX (Vulnerability Exploitability eXchange) is a CISA specification formalized in April 2022. A VEX document assigns one of four statuses to a CVE in a specific software context: not_affected, under_investigation, affected, or fixed. Docker DHI uses a subset. It never sets fixed because a scanner comparing version numbers alone would miss a backported patch. Instead, DHI marks patched issues as not_affected with the justification inline_mitigations_already_exist. Machine-readable, audit-friendly, and compatible with CycloneDX and OpenVEX implementations.
The result: a scanner that understands VEX sees a CVE, checks the VEX statement, finds not_affected + inline_mitigations_already_exist, and drops the alert. What was a 200-CVE scroll becomes a handful of items that actually need attention.
The open-source alternative
The open-source path exists. You do not need Black Duck for this. Trivy accepts OpenVEX documents directly: trivy image --vex=openvex.json myimage:tag filters known-not-affected findings at scan time. Grype supports the same flow. The vexctl CLI generates and manages OpenVEX documents for free.
The gap is automation. Trivy and Grype will ingest VEX data, but they will not auto-detect that your base layer is a DHI image and pull the right statement. You maintain the VEX file yourself. Black Duck also ships BDSA advisories, proprietary alerts that the vendor claims arrive "days before NVD," though no independent benchmark confirms that timing.
Full disclosure: I build LogStrip, which attacks the same noise from the other end. It does not decide which CVE matters; it compresses a Trivy or Snyk report and trims it to a --max-tokens budget before an AI agent reads it. I will cover it in a separate article.
The commercial angle
DHI base images are free under Apache 2.0. Over 1,000 hardened images cover popular runtimes, open since December 2025. The VEX data itself is public and scanner-agnostic. Wiz and Mend.io have their own DHI+VEX integrations shipping this year.
But the Black Duck automation layer is commercial, with pricing that is not public. SCA integration is roadmap-only. The pipeline looks like this: free hardened base image, free VEX data, paid analysis tool, paid auto-suppression policy. The value proposition is convenience, not capability. You can assemble the same stack with Trivy + OpenVEX for free if you are willing to write the glue. The question is whether your organization pays Black Duck to skip a shell script.
Docker says bulk policy enforcement clears "thousands of non-actionable alerts with zero manual effort." That is a vendor blog without an independent audit. Your mileage will depend on how many DHI layers you actually run and how noisy your current scanner output is.
Comparison data
| Auto DHI detection | VEX filtering | Proprietary advisories | Free tier | |
|---|---|---|---|---|
| Black Duck BDBA | Yes | Yes | Yes | No |
| Trivy + OpenVEX | No | Yes | No | Yes |
| Grype + OpenVEX | No | Yes | No | Yes |
| Docker Scout (native) | Yes | Yes | No | - |
Beyond Docker+Black Duck, the bigger story is that VEX is moving from specification to product integration. CISA defined it in 2022. Microsoft ships machine-readable VEX for every CVE since October 2025.
The EU Cyber Resilience Act will require vulnerability transparency that VEX addresses. The standard is winning. The convenience wrapper around it is optional, and priced accordingly.