While teams are overwhelmed by vulnerability assessments, they rarely understand how popular vulnerability scanners arrive at these determinations.  Using popular container scanning tools for illustration, we will break down how your tooling goes from beginning a scan to delivering findings.  From that foundation, we'll work through how to read bulletins for a particular CVE and understand what the technical language means.  Finally, we'll work through how teams can ensure that the results are accurate and applicable.