Findings on the remediation register all reach the same moment: someone has to decide how this one actually ends. In SecOps — the working-contract SecOps definition at the Ops Atlas — every finding deserves an owner and a date, but the date means nothing until the closure method is chosen too. There are exactly two. Reconfigure the estate you already run, or rebuild from a clean image and replace what runs. The choice is architectural, not a preference, and picking the wrong one quietly wastes weeks. This comparison keeps both paths side by side, in the practical spirit of a packing list: what each costs, what each risks, and how each one proves it is finished.
Path one: the SecOps reconfiguration route
The classic route. A configuration change reaches live machines — usually through an agent or a management system — and the finding closes when a fresh scan grades the machine clean. Done under the contract’s discipline, it follows the sequence the whole method is named for: pick the benchmark, record the tailoring, rehearse on a scratch host, then watch a log-only window on a pilot ring before enforcing ring by ring. The method’s strengths are real. Nothing gets thrown away; the change is small and auditable; and the evidence accumulates naturally, log by log, in the exact style Microsoft modelled during its two-stage Netlogon enforcement, when logging ran months before anything was denied outright. The costs are equally real: each machine needs a change window, careful estates move slowly, and configurations left unattended drift back toward the old, comfortable state. Closure here is a monitoring commitment, not a one-time event. Budget accordingly: the finding is only finished when the drift monitoring that guards it has survived at least one full patch cycle and one absent engineer.
Path two: the SecOps rebuild route
The second route changes the destination of the fix. Instead of adjusting machines, you adjust the recipe: the golden image, the container base, the machine template. NIST SP 800-190 formalised this for containers, and its closure test is strict in a way worth quoting precisely — the finding routes to the image owner, and the job is done only when the rebuilt image passes its scan AND the estate holds zero instances still running from the old build. Both conditions. A clean image with old instances still cycling is a closed ticket over an open wound. The strengths mirror the weaknesses of path one: rebuilding is repeatable, drift-resistant by construction, and turns every future machine into a compliant one for free. The costs: image pipelines must exist and be trusted, rebuild cycles take investment to keep quick, and the fix lands on the image owner’s desk — which only works when the register can actually route findings to that person. Teams discovering their pipeline is a folder of undocumented scripts should treat pipeline hardening as finding zero; every other closure downstream inherits its fragility.
The anti-pattern that gives path two its bad name
You will meet teams who “fix” containers by reaching into running ones — a quick patch, a manual config change, finding closed. The next redeploy silently rebuilds the machine from the unmodified image and the flaw returns, undetected, with a closure note still attached. Patching running containers is the canonical example of work that evaporates; the unit of change was wrong, so the durability was zero. The rule of thumb that survives every environment: if a thing is replaced rather than repaired, its fixes belong in the thing it is replaced from.
Side by side, without decoration
Set the two paths against each other and the differences are concrete:
- Unit of change: a setting on each live machine, versus a revision to the image everything is built from.
- Closure proof: a clean re-scan of the running estate, versus a clean scan of the rebuilt image plus zero surviving old instances.
- Drift behaviour: machines relax back toward old settings unless watched, versus new instances that inherit compliance automatically.
- Speed of first fix: faster for one machine on path one, faster for a thousand machines on path two.
- Failure mode: an interrupted change or a missed window, versus a pipeline nobody has exercised since onboarding.
Choosing without drama
Long-lived servers with careful change management lean toward reconfiguration; container fleets and autoscaling groups lean hard toward rebuilding; most real estates need both, separated by asset class and recorded in the register so nobody improvises the choice per finding. Two tests settle most borderline cases. Ask who would have to approve the change — if the honest answer is “whoever owns the image”, the finding was never a machine-level fix. And ask what happens at the next redeploy: if the answer undoes the fix, the decision has already been made by the architecture. Whichever path wins, the paperwork is identical — same register, same owner, same date — because closure method and closure governance are different clauses of the same contract. Write the chosen method into the entry itself, so the person closing the finding and the person auditing the register never have to guess which proof a “closed” label refers to.
Comparing options before committing is its own discipline, one that travel plans reward just as highly — start with the basics in our first-timer’s guide to planning a Kerala trip, or apply the same build-versus-buy thinking to hardware choices via this simple guide to choosing drones and finding services. Readers mapping these closure paths onto a working career will find the foundation in a DevOps career guide to skills, projects and paths. Choose the ending deliberately, write it down, and let the register carry it. Findings, unlike monsoon showers, do not pass on their own.
