# Inspector Not Enabled

> Amazon Inspector v2 scans EC2 instances, ECR container images, and Lambda functions for known CVEs and unintended network reachability across all 3 surfaces continuously. ZopNight raises this finding only when the discoverer positively reads enabled=false for the account and region; an unreadable state produces no finding at all.

Source: https://zop.dev/integrations/aws/recommendations/inspector-not-enabled
Updated: 2026-08-19

---

## Vulnerability management, not threat detection

Inspector answers a different question from GuardDuty, and the two are frequently confused
into a single "security is on" checkbox. GuardDuty watches behaviour: is something attacking
you now. Inspector watches software state: which of your EC2 instances, ECR images, and
Lambda functions carry known-exploitable package versions, and which of those are additionally
reachable from the network. An account can have spotless threat detection and still be
running a two-year-old OpenSSL everywhere; only Inspector reports that.

## The evidence gate

The discoverer probes the Inspector account status and writes an explicit enabled flag into
the resource metadata. Only a confirmed false fires. A missing or unparseable flag (the probe
was denied, the region errored) abstains, because "we could not read the scanner's status"
and "the scanner is off" are different claims and only the second belongs on a compliance
report. A fired finding is therefore a proven statement about the region, not an inference.

## What continuous scanning changes operationally

Point-in-time scanners produce a report that is stale by the next deploy. Inspector v2
re-evaluates when a new CVE is published or when a workload changes. A fresh critical CVE in
a base image surfaces against every affected ECR image and running instance within hours,
ranked by an exploitability-aware score rather than raw CVSS. That ranking matters at fleet
scale: an internet-reachable instance with a network-exploitable CVE and a private batch
worker with the same package are not the same priority, and Inspector's reachability analysis
distinguishes them for you.

## Query the current state

```bash
aws inspector2 batch-get-account-status \
  --query 'accounts[].[accountId,state.status,resourceState.ec2.status,resourceState.ecr.status,resourceState.lambda.status]' \
  --output table
```

## Enable it where it compounds

Per-account enablement works, but the multiplier is AWS Organizations: delegate an admin
account and auto-enable EC2, ECR, and Lambda scanning for every member, so new accounts are
born covered. [Pricing scales with scanned instances and images](https://aws.amazon.com/inspector/pricing/); the finding itself carries no
savings figure because turning a scanner on never does. It trades a known monthly cost for
not learning about a CVE from an incident channel.