Tools · SPBoucher
Menu

Trivy

by Aqua Security · CLI tool · also known as Aqua Trivy

Open-source scanner that finds known vulnerabilities, misconfigurations, exposed secrets and license issues in container images, file systems, git repositories, IaC and Kubernetes clusters

Apache-2.0 licenseOpen sourceFreeLocalSelf-hostedSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

Trivy is a security scanner from Aqua Security released under Apache-2.0. One binary scans several kinds of targets: container images and their OS packages and language dependencies, local file systems and git repositories with lockfiles, infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts), virtual machine images and running Kubernetes clusters. For each it reports known vulnerabilities from a regularly updated database, misconfigurations against built-in policies, hard-coded secrets and dependency licenses, and it can generate or consume SBOMs in CycloneDX and SPDX formats.

It is commonly wired into CI through official GitHub Actions and GitLab templates to fail builds on high-severity findings, run as a Kubernetes operator for continuous cluster scanning, or used interactively before pushing an image. Output formats include a table, JSON, SARIF and templates.

Trivy detects known issues in packages and configuration; it does not analyze first-party source code logic, and results depend on accurate package metadata and a reachable or mirrored vulnerability database.

Capabilities

  • Vulnerability scanning of OS packages and language dependencies in images, file systems and repositories
  • Misconfiguration checks for Terraform, Kubernetes, Dockerfiles, Helm and CloudFormation
  • Secret detection and license reporting
  • SBOM generation and scanning (CycloneDX, SPDX)
  • Kubernetes cluster scanning and operator mode
  • SARIF, JSON and template outputs for CI integration

Typical workflows

  1. Fail a CI build when an image contains critical vulnerabilities
  2. Audit Terraform and Kubernetes manifests before apply
  3. Produce an SBOM for a release artifact

Strengths

  • Single binary covering many target types
  • Apache-2.0 license with frequent database updates
  • Straightforward CI integration

Limitations

  • Finds known issues only; no first-party code analysis
  • Requires database downloads or a mirror in restricted networks
  • Policy coverage varies by IaC format

Prerequisites

  • Trivy binary or container image
  • Network access to the vulnerability database or a local mirror

Who it is for

  • DevOps and platform engineers
  • Security teams scanning images and IaC

Alternatives & comparison

Semgrep analyzes patterns in first-party source code; Trivy looks at dependencies, images, configuration and clusters for known vulnerabilities and misconfigurations. Teams usually run both.

  • Semgrep

    Static analysis engine that matches code patterns written in the target language's own syntax, with an LGPL community edition and a commercial AppSec platform

    MixedOpen source

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    Trivy LICENSE (Apache-2.0)

    https://github.com/aquasecurity/trivy/blob/main/LICENSE

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    Trivy Documentation

    https://trivy.dev/docs/latest/guide

    Supports: capabilities, data_formats, workflows

    checked Nov 1, 2026
  • Official site
    Trivy

    https://trivy.dev/

    Supports: name, summary, vendor, capabilities

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Cloudflare

Cloudflare, Inc. · DNS & domains

Global network offering authoritative DNS, CDN and reverse-proxy security, a domain registrar, Zero Trust access and the Workers serverless platform

ProprietaryFreemiumPaidNov 2, 2026

Fail2Ban

Fail2Ban project · Security tools

Log-scanning intrusion-prevention daemon that temporarily bans IP addresses showing repeated authentication failures by updating firewall rules

GPL-2.0-or-laterOpen sourceFreeSelf-hostedNov 2, 2026

CrowdSec

CrowdSec · Security tools

Open-source behavior-based intrusion prevention engine whose detections feed a crowd-sourced IP reputation network, with remediation components for firewalls, proxies and CDNs

MITOpen sourceFreemiumSelf-hostedNov 2, 2026

promptfoo

Promptfoo, Inc. · Prompting, evaluation & observability

Open-source, local-first CLI and library for evaluating prompts, models, RAG pipelines and agents, with automated red teaming and CI integration

MITOpen sourceFreeLocalSelf-hostedBroken