Container Image Security Patents: Who Leads, Where the Gaps Are 2026
- 77.9% concentration. The top 5 assignees account for 67 of the 86 records in scope, with a single leader filing 24 — the rest of the field is a long tail of single- and few-filing entrants.
- Filing doubled 2021 to 2024. From 6 filings in 2021 to 12 in 2024, before the count trails off in 2025-2026 as recent filings are still being published.
- One subclass dominates the claim space. G06F covers 93.0% of all 86 records, with H04L layered on top of nearly a third of them — signature verification and registry access control claims sit almost entirely inside these two classes.
Filing growth compares 2021 (6 records) with 2024 (12) — a three-year span. 2024 is the most recent year we treat as complete: publication lags filing by roughly 18 months, so 2025 onwards are still filling in and any growth rate that ends there would understate the field. Top-5 share is the combined record count of the five largest assignees divided by all 86 records in scope (CR5), not by the ranked leaders only.
What this landscape covers
Container image and base layer security spans the mechanics of verifying what actually ships inside a container: image signature verification, layer provenance, package metadata, registry access control and privilege reduction at the point an image is pulled or built. This is where 86 records published between 2015 and mid-2026 sit, drawn from a search string that pairs image-scanning and signature-verification terms with the supporting infrastructure — provenance, metadata, registry access and base-image handling — that makes scanning results actionable rather than cosmetic.
The set is small enough that a handful of assignees define the shape of the claim space, and concentrated enough in IPC terms that most of the contested ground sits inside data processing and digital transmission classes rather than spreading across the classification system.
Filing trend and technology composition
Two views of the same 86 records: how filing activity has moved year over year, and which IPC subclasses carry the claims.
Filing trend, 2017-2026
Filings rose from 2 in 2017 to a peak of 13 in 2022, then doubled from 6 in 2021 to 12 in 2024 — the clearest complete-year comparison available. 2025 and 2026 show lower counts, but publication lags filing by roughly 18 months, so those two years are still filling in rather than signalling a slowdown.
IPC subclass composition
G06F (electric digital data processing) appears on 93.0% of the 86 records, and H04L (digital information transmission) on 32.6% — these two classes carry almost all of the claim activity. G06Q, G01N and G06N each register at 2.3% or below, marking them as marginal rather than active fronts. Because records can carry more than one class, these shares add up to more than 100%.
Shares are the percentage of the 86 records in scope. A patent can carry several IPC classes, so the shares add up to more than 100%.
Go deeper on Container Image and Base Layer Security with Eureka
This page is one run against one query. Ask Eureka your own question about container image and base layer security and every answer comes back with the patent numbers behind it.
Try EurekaThe most-cited records and a recent filing worth reading in full
US20260072719A1 — Substitution-based container image layer deployment
Generates layer substitution relationship data for one or more image layers of a container image, specifying substitution relationships between different layers. On a download request for a target layer, the process identifies an image layer subset that omits superseded layers, based on the substitution relationship data.Filed by an IBM-affiliated entity and published 2026-03-12, this filing targets the deployment mechanics of layer substitution rather than scanning or signing — a sign that claim activity is moving from detection toward how verified layers get assembled and served.
| # | Publication no. | Patent title | Citations |
|---|---|---|---|
| 1 | US20170180346A1 | Software container registry service | 286 |
| 2 | US20170177860A1 | Software container registry container image deployment | 236 |
| 3 | US20170177877A1 | Software container registry inspection | 202 |
| 4 | US10002247B2 | Software container registry container image deployment | 119 |
| 5 | US20190354389A1 | Container image building | 100 |
| 6 | US20210382997A1 | Method and apparatus for providing visibility of security into container images | 75 |
| 7 | US10032032B2 | Software container registry inspection | 67 |
| 8 | US10725775B2 | Software container registry service | 65 |
| 9 | US10261782B2 | Software container registry service | 65 |
| 10 | US20170187540A1 | Detection of vulnerable root certificates in software containers | 39 |
Citation counts favour older records simply because they have had longer to accumulate them — read this as a map of foundational filings, not of what matters most today.
Each row carries its publication number; clicking a row searches Eureka by that number.
Put your own technology through the same analysis
Eureka on the web
When you want the answer in the next five minutes.
The agent works the prompt against patents and technical literature, citing every source.
Run your analysis now →MCP server & REST API
When it has to run inside your own pipeline.
Patent search, landscape analysis and assignee resolution as MCP tools. Drop them into any agent framework, or call REST directly.
Browse MCP servers →What the numbers mean for filing strategy
Three findings that shape where new claims can realistically land.
The field is top-heavy
A single leader holds 24 of the 86 records, and the top 5 combined hold 67 — 77.9% of everything in scope. Filing into the same claim territory as the leader means designing around a dense existing position, not entering open ground.
Momentum is real, not recent noise
Filings doubled from 6 in 2021 to 12 in 2024, the most recent year with a complete publication record. That is sustained growth over a three-year span, not a single spike, which suggests the underlying technology area is still actively being claimed rather than settling.
Claims cluster in two IPC classes
G06F and H04L together account for the overwhelming majority of classified activity, with G06Q, G01N and G06N appearing on 2.3% of records or fewer. Anyone drafting outside G06F/H04L combinations is filing into genuinely thin prior art by IPC measure.
The tail thins out fast
Fifth place holds 5 records and tenth place holds only 2 — the drop from leader (24) to fifth (5) to tenth (2) is steep, meaning most of the ranked assignees are single- or double-filing entrants rather than sustained programmes.
Eureka can read the same corpus for gaps instead of for coverage: under-claimed branches adjacent to container image and base layer security, with the prior art for and against each one.
Who is filing, and where the claim space is still open
The ranked leaders cover cloud infrastructure, network security and enterprise storage vendors; the gate below marks sub-areas that remain lightly claimed relative to the core scanning and signing routes.
One assignee sets the pace
The top-ranked assignee holds 24 of the 86 records in scope, more than four times the fifth-place count of 5. Recent-year momentum for this leader and several others in the ranking shows 0 filings in the latest year, consistent with the 18-month publication lag rather than a pullback.
A cluster of sustained but smaller programmes
Between the leader and the long tail sits a group of assignees spanning network security, enterprise storage and hardware vendors, each holding a handful of records — enough to signal an active programme without approaching the leader's scale.
Everyone else files once or twice
With the top 10 already accounting for 94.2% of all 86 records, the remaining assignees in the ranking are largely single-filing entrants — useful as a signal of who is experimenting with the technology, not as a competitive threat on their own.
| Assignee | Recent year | YoY |
|---|---|---|
| Amazon Technologies, Inc. | 0 | — |
| Wiz, Inc. | 0 | -100% |
| International Business Machines Corporation (IBM) | 0 | -100% |
| Cisco Technology, Inc. | 0 | — |
| Hewlett Packard Enterprise Development LP | 0 | — |
| Thales DIS France SA | 0 | — |
| Pure Storage, Inc. | 0 | -100% |
| Electronics and Telecommunications Research Institute (ETRI) | 0 | — |
Where to take this analysis
The dataset points to a field with a dominant leader and open ground just outside the core scanning-and-signing claims.
Map the leader's claim boundaries
Before filing near the top assignee's territory, work out exactly which layer-substitution and registry mechanics its 24 records already cover.
Explore assignee claims in Eureka →Test a white-space claim
Rebuild-frequency-triggered re-verification and cross-registry provenance attestation both sit outside the dense G06F/H04L core — worth a novelty check before committing drafting time.
Run a novelty search in Eureka →Watch the 2024-2026 filings as they publish
Because publication lags filing by about 18 months, the real 2025-2026 filing count is still arriving — set an alert rather than reading the current dip as a slowdown.
Set up monitoring in Eureka →Common questions about container image security patents
One assignee leads with 24 of the 86 records in scope, and the top 5 assignees combined hold 67 records, or 77.9% of the field. The ranking drops off quickly after that: fifth place holds only 5 records and tenth place holds 2, so beyond the leading group most assignees have filed just once or twice. This concentration means a large share of the claim space around scanning, signature verification and registry access control is already occupied by a small number of players.
Filings grew from 6 in 2021 to 12 in 2024, a complete-year doubling that indicates sustained rather than one-off activity. The peak year so far is 2022 at 13 filings. Counts appear lower in 2025 and 2026, but patent publication typically lags filing by around 18 months, so those most recent years are still incomplete and should not be read as a decline.
By IPC classification, 93.0% of the 86 records carry G06F (electric digital data processing) and 32.6% carry H04L (digital information transmission), meaning almost all claim activity sits inside these two classes, often overlapping on the same record. Smaller classes like G06Q, G01N and G06N appear on 2.3% of records or fewer, marking business-process, materials-testing and AI-model angles as marginal rather than active fronts in this dataset.
The gate areas outside the dense scanning-and-signing core include layer substitution relationship metadata, registry-side privilege reduction applied at pull time, rebuild-frequency-triggered re-verification, cross-registry provenance attestation and AI-assisted package metadata classification. These sit adjacent to the crowded G06F/H04L claim territory but are not where the bulk of the 86 records land, making them worth a novelty check before drafting. High density in the core classes signals occupied claim space, not that the underlying technology problem is solved.
US20260072719A1, published 2026-03-12 and filed by an IBM-affiliated entity, claims layer substitution relationship data that identifies which superseded image layers can be omitted from a download based on target-layer requests. That is a shift from detecting problems in an image toward controlling how verified layers get assembled and served at pull time. It suggests some of the newer claim activity is moving past scanning and signature verification into the deployment mechanics that sit downstream of them.
Research Container Image and Base Layer Security in depth with Eureka
Go past this page: query the whole container image and base layer security corpus yourself, in your own scope.
Every answer comes back with patent numbers you can open.
Disclaimer. This page is generated from Patsnap Eureka data drawn from a limited snapshot of global patent and scientific-literature records, and is provided for general information and reference only.
Patent data carries inherent limitations: recent filings (typically the most recent 18–24 months) are under-counted due to standard publication lag; counts may be reported at either a patent-family or a patent-record basis and are not always directly comparable; classification, applicant-name, and citation data may contain errors, duplicates, or omissions; and the underlying search query defines and constrains the scope shown. As a result, the analysis may be incomplete or inaccurate and may not reflect the full technology landscape.
Nothing on this page constitutes an exhaustive prior-art, novelty, freedom-to-operate, or validity search, nor does it constitute legal, financial, investment, or professional advice, and it should not be relied upon as such. Any patent, commercial, or strategic decision should be verified independently and reviewed with qualified patent, legal, and domain professionals. Patsnap makes no warranties, express or implied, as to the accuracy, completeness, or fitness for any particular purpose of the information presented.
Machine translation. Assignee and organisation names originally recorded in Chinese, Japanese or Korean have been rendered into English by an AI translation step so that the tables stay readable. These renderings are best-effort and may not match a company’s registered English name; the original name is what the underlying patent record carries, and it is what any Eureka query launched from this page uses.