A company needs host-based security for Amazon EC2 instances and container images in Amazon Elastic Container Registry (Amazon ECR). SSM Agent is installed on all EC2 instances. All AWS accounts are in a single AWS Organizations organization. The company will analyze workloads for software vulnerabilities and unintended network exposure and send findings to AWS Security Hub at the organization level. The solution must automatically deploy to all current and new member accounts and automatically scan new workloads as they appear. Which solution meets these requirements?

The correct solution is to designate a delegated administrator for Amazon Inspector for the organization and enable automatic scanning for new member accounts. Amazon Inspector is a vulnerability management service that automatically discovers and scans Amazon EC2 instances and container images in Amazon ECR for software vulnerabilities and unintended network exposure. By designating a delegated administrator in AWS Organizations, Inspector can be centrally managed across all accounts, including automatic enablement for new member accounts. Findings are automatically sent to AWS Security Hub. Incorrect options: Service control policies (SCPs) manage permissions but do not configure or initiate security scanning services like Inspector. Amazon GuardDuty is a threat detection service, not a vulnerability management service for host-based scanning of EC2 instances and ECR images. While EventBridge can trigger actions, it's not the primary mechanism for Inspector's automatic scanning. An AWS Config rule can monitor resource compliance but does not initiate Inspector's ECR image analysis; Inspector handles this automatically once enabled.