Trivy
One open-source scanner for containers, filesystems, repos, IaC and Kubernetes.
What it is
Trivy scans container images, filesystems, git repositories, infrastructure-as-code and running Kubernetes clusters for vulnerabilities, misconfigurations, secrets and licence issues — all from a single fast binary with no server component. It has become the default scanner in container pipelines.
Best for
Where it is strong
- Free and covers container, IaC, secret and dependency scanning in one binary.
- Fast enough to run on every image build without slowing the pipeline.
- Excellent Kubernetes integration through the Trivy Operator.
Where it falls short
- No hosted dashboard or workflow — findings go to your pipeline output.
- No reachability analysis, so alert volume is high on large images.
- Reporting for compliance requires building it yourself.
Pricing
Free and open source
Open sourceFree tier: Everything, self-hosted
What drives the bill: Free and open source. You pay in engineering time and CI minutes.
Check current pricing on Aqua Security’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use Trivy say
No reviews of Trivy yet. If you have used it in anger, yours would be the first.
Alternatives to Trivy
If Trivy is not the right fit, these solve the same problem differently.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
Mend.io
Security Testing
Software composition analysis with automated remediation and licence compliance.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.