containers Your 12,064 Findings Are Lying to You: Counting Images, Not Reports, with the Trivy Operator Trivy Operator emits one VulnerabilityReport per workload, not per image. Sum the reports and you double-count everything. Here is the jq that gets the real number.