starter.wikiSearch⌘K

Open-source artifact scanning

Trivy

An open-source scanner for supported container images, filesystems, repositories, virtual-machine images, Kubernetes targets, packages, IaC, secrets, and licenses.

Visit official site

Editorial verdict

Choose Trivy when open-source local and CI artifact scanning fits the target matrix and the team can own databases, configuration, policy, false positives, triage, upgrades, and remediation.12

Best for

  • Container-image and filesystem scanning
  • CI scanning of supported packages, IaC, secrets, and licenses
  • Teams wanting an open-source scanner under their operational control
12

Not ideal for

  • Organizations seeking a turnkey managed AppSec platform
  • Deep application SAST as the leading requirement
  • Teams unable to maintain scanner databases, configuration, policy, triage, and upgrades
12
Main trade-off

Broad open-source artifact scanning reduces license and platform dependence while transferring workflow, data freshness, tuning, governance, reliability, and remediation to the team.12

Product boundary

Whether the team should operate Trivy in local and CI workflows for the exact artifacts and finding types it supports.

Trivy scans configured targets and finding classes; it is not complete SAST, runtime protection, a managed remediation program, or proof that an artifact or application is secure.12

For: Platform, DevOps, and application-security teams wanting an open-source artifact scanner they can run and govern

  • A required target or finding class is unsupported.
  • Scanner database freshness or CI operation cannot be governed.
  • A managed multi-team triage and compliance workflow is required.

Why teams consider Trivy

  • Target breadthImages, filesystems, repositories, VM images, and Kubernetes are documented targets.12
  • Finding breadthSupported packages, vulnerabilities, IaC misconfiguration, secrets, and licenses can be scanned.12
  • Open-source controlThe Apache 2.0 project can run locally and in team-owned CI.12

Pricing

Trivy is open-source software with no separate software license fee; total cost is CI compute, caching, database updates, storage, policy, triage, support, upgrades, and remediation engineering.12

Team-operated artifact scanning

Trivy OSS

Model CI and registry compute, database mirrors and updates, caching, policies, suppressions, reporting, support, upgrades, triage, and remediation.12

License
Apache License 2.012
Operational boundary
No separate software fee does not remove scanning and remediation cost12
Pricing checked View official pricing

Trivy vs alternatives

Snyk

Choose when
A managed developer-security platform and governed team workflow justify commercial products.
Avoid when
The required product, contributor, or contract surface is disproportionate.
Compared with Trivy
Managed workflow replaces open-source operating control.45

GitHub Dependabot

Choose when
The primary job is GitHub-native dependency alerts and update pull requests.
Avoid when
Images, filesystems, Kubernetes, IaC, secrets, or local scanning are required.
Compared with Trivy
A narrow native dependency workflow replaces artifact breadth.67

Semgrep

Choose when
Rule-driven code and policy analysis should lead the security workflow.
Avoid when
Container and artifact scanning are the primary jobs.
Compared with Trivy
Code-policy depth replaces Trivy's artifact target breadth.89

Resources and sources

Official product, policy, and pricing

  • Trivy repository and target overview
    Open
  • Trivy User Guide and targets
    Open
  • Trivy Apache 2.0 license
    Open
  1. 1
    Trivy repository and target overview

    Aqua Security · Accessed Official

  2. 2
    Trivy User Guide and targets

    Aqua Security · Accessed Official

  3. 3
    Trivy Apache 2.0 license

    Aqua Security · Accessed Official

  4. 4
    Snyk Container

    Snyk · Accessed Official

  5. 5
    Snyk plans

    Snyk · Accessed Official

  6. 6
    Dependabot alerts

    GitHub · Accessed Official

  7. 7
    Dependabot security updates

    GitHub · Accessed Official

  8. 8
    Semgrep AppSec Platform

    Semgrep · Accessed Official

  9. 9
    Semgrep pricing

    Semgrep · Accessed Official