How do you optimize vulnerability ownership tracing across microservices?

The organization has numerous container images with no ownership data, and struggles to track vulnerabilities in a microservices environment where multiple teams build on shared base images. When a CVE is discovered in an image layer, their scanning tool cannot identify which services use the vulnerable version, which teams own those services, or whether the vulnerable code is actually invoked. In a recent incident, three teams spent two days combined confirming that a vulnerable function wasn't called in their services, prompting the search for an automated way to trace from vulnerability findings to deployments, owning teams, and actual exposure.