Container Security and Vuln Management

I am down the path of ticketing vulnerabilities at the running container. Obviously this doesnt scale well and I realize it’s better to take an image based view. My concern is selling this type of change to my leadership, audit, etc.

I am looking for strongholds like NIST or CISA says you should use image based, but have yet to find anything like this. Does anyone have credible backing for image based reporting? Or something that speaks to best handling …

audit change cisa container container security cybersecurity down etc image leadership management nist path running scale security selling ticketing vuln vulnerabilities vuln management