By Steve Kamerman
A few years ago, a single vulnerability in libpng — the library that decodes PNG images on every phone and browser on the internet — left over a billion people exposed. Most enterprises never knew it happened.
That’s the state of image infrastructure today. Enormous scale, enormous cost, and a security attack surface that almost nobody is managing. Most large organizations either overpay a SaaS provider that can’t show what’s running under the hood, or piece together their own solution and hope nothing goes wrong.
Neither approach holds up at enterprise scale.
The cost problem nobody sees coming
ScientiaMobile has been the world leader in mobile device detection for 15 years. ImageEngine was built to put that data to work — knowing exactly which device is visiting your site lets us serve a precisely optimized image for that device, instead of one size that works poorly for everyone.
The result: more than half our customers see an 80% reduction in image payload. For a site with three million monthly visitors, that typically means going from 7,200 gigabytes of images delivered per month to 1,800. At CDN pricing, that’s hundreds of thousands of dollars a year — for companies that often had no idea they had a problem.
Image costs grow invisibly. The trajectory looks exactly like AWS’s free tier: fine at first, then suddenly overwhelming. And there’s one specific scenario worth flagging — a single person refreshing product images without cache-busting parameters can generate a bill three times your normal monthly spend in one afternoon. It will happen to you eventually.
Why SaaS stops working at scale
The reflex is to hand this off to a popular image SaaS platform. At small scale, that’s reasonable. At enterprise scale, two things break down.
You lose pricing control. Every byte they serve is infrastructure they bill you for — at their margin. Once you’re fully integrated, you have no leverage. They can raise prices 20% next year, and your only option is a painful migration.
The economics never worked for large customers. We’ve seen competing SaaS providers cut enterprise contracts by 75% — in one case more than $100,000 a month — to avoid losing an account. That’s not generosity. That’s margins that were never justified. When a customer mentions they have an alternative and gets their bill cut by three-quarters, it tells you how much they were overcharging before.
The historical excuse for paying the SaaS premium was valid: managing a complex image processing stack required dedicated people. That excuse is gone.
What Kubernetes actually changed
Kubernetes eliminated the maintenance burden that justified SaaS pricing. You can now deploy a complex software stack with a single Helm command and let it run. SaaS providers figured this out years ago — they stopped paying infrastructure teams and started running cloud-native applications, just like you can. Their costs dropped. Yours didn’t, because you were still paying their old margin.
ImageEngine Kube packages the same software we’ve run for our own customers for years and deploys it in your environment, on your infrastructure. On Kubernetes, the full stack is running in five to ten minutes. AWS, DigitalOcean Google Cloud Platform, and Linode all support Kubernetes natively, so you don’t need to be a Kubernetes expert to use it. OCI/Docker containers are also available if you prefer.
The cost structure is straightforward:
- Your existing infrastructure (which you’re likely already over-provisioned on) plus a flat licensing fee
- No usage-based billing
- No surprise surges
- No vendor that can reprice you once you’re locked in
The security problem nobody is talking about
A second problem with your image pipeline has nothing to do with cost — and almost no organization is addressing it.
Every image uploaded to your platform gets decoded by software. That software has vulnerabilities. When a vulnerability is publicly disclosed, everyone—including attackers—knows how to exploit it at the same time.
The attack is straightforward: upload a malicious image to a marketplace or review platform, get an employee to view the listing, and if their decoder is unpatched, you have remote code execution. If the image reaches your CDN, every user who visits that page is exposed. No antivirus protects image decoders—these attacks sit below the layer security tools monitor.
ImageMagick, the most widely deployed image processing library in the world, has had 190+ critical vulnerabilities disclosed in the past two years.
Your SaaS provider is running the same open-source decoders — libpng, libjpeg, ImageMagick — as everyone else. The difference is you can’t see which versions they’re running or whether they’re patched. Ask them. They won’t be able to answer, because showing that information would expose their stack.
What Kube does differently
On-premises deployment makes transparency possible in a way SaaS fundamentally cannot.
- No known critical CVEs at release — enforced in the build process, not just a policy
- Universal re-encoding — every uploaded image is decoded and re-encoded through a patched pipeline, destroying any exploit payload before it reaches storage or users
- Full software bill of materials — every library, every version, every CVE status, visible and auditable
- Signed container images — every container we ship is cryptographically signed, so you can verify the software running in your cluster is what we built and hasn’t been modified in transit. Paired with the SBOM, you know exactly what’s inside the stack and that it came from us.
Content provenance is the other half of the problem. As AI-generated imagery becomes indistinguishable from authentic photography, chain-of-custody for the images you deliver matters more every year. We’ve joined the Coalition for Content Provenance and Authenticity (C2PA) — the Adobe-founded, Google/Microsoft/BBC-backed standard for cryptographically signing images — and C2PA signing for images passing through your pipeline is on Kube’s roadmap.
One question to ask your provider or internal team today
“Which version of libpng are you currently running, and what’s your process for patching critical CVEs?”
If they can’t answer specifically — and they won’t be able to — that’s your answer.
You’re serving users images through a pipeline you can’t audit, from a vendor who can’t show you what’s inside, on pricing that gets less favorable the more dependent you become. For enterprises evaluating image infrastructure seriously, these four questions are worth sitting with:
- How secure is your image pipeline?
- Can you predict your image costs month to month?
- Does your cost grow proportionally with traffic — or exponentially?
- If your provider raises prices 30% next year, what’s your alternative?
If any of those land badly, that’s the conversation Kube is built for.
ImageEngine Kube is a containerized image optimization engine built for organizations that need full control, auditability, and predictable costs at enterprise scale. Deploy on Kubernetes in minutes.