Skip to content
THREATWIRE

Trivy

All-in-one scanner for images, code, IaC and clusters

Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

Open sourceApache-2.0
Alternative toSnykPrisma CloudWiz
Visit website View repository Docs
Homepage of Trivy
Official website (trivy.dev), captured by ThreatWire.

What Trivy does

Trivy combines several scanners in one binary: vulnerable OS packages and language dependencies, misconfigurations in IaC files, exposed secrets and software licences. It can scan container images, local file systems, Git repositories, virtual machine images and running Kubernetes clusters.

It can also generate and consume SBOMs in CycloneDX and SPDX formats. Its speed and simple setup have made it a default choice in many CI pipelines; Aqua Security maintains it as an open-source project.

Key features

  • Vulnerability scanning of OS packages and dependencies
  • IaC misconfiguration and secret scanning
  • Container image, file system, repo and VM targets
  • Kubernetes cluster scanning
  • SBOM generation (CycloneDX, SPDX)

Licence

Apache-2.0 · Apache License 2.0 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of Trivy itself

5 published advisories for Trivy in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Container and Kubernetes securityDependencies and SBOM (SCA)Cloud and IaC securitySecrets detection#containers#kubernetes#sbom#iac#cli#security#security-tools#docker#vulnerability-scanners#vulnerability-detection

Related tools

  • Kubescape

    Kubernetes security posture and compliance scanner

    CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.

    Stars
    12k
    Forks
    1.1k
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toWizPrisma Cloud

  • Checkov

    Static analysis for infrastructure as code

    Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.

    Stars
    9.1k
    Forks
    1.4k
    Last commit
    6 days ago
    Apache-2.0Open sourceCloud and IaC security
    Alternative toPrisma CloudWiz+1

  • kube-bench

    CIS Kubernetes Benchmark checks

    Aqua Security tool that checks whether Kubernetes nodes and control-plane components are configured according to the CIS Kubernetes Benchmark.

    Stars
    8.2k
    Forks
    1.3k
    Last commit
    14 days ago
    Apache-2.0Open sourceContainer and Kubernetes security

  • Prowler

    Cloud security posture and compliance checks

    Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.

    Stars
    15k
    Forks
    2.4k
    Last commit
    today
    Apache-2.0Open sourceCloud and IaC security
    Alternative toWizPrisma Cloud

  • Grype

    Vulnerability scanner for images, file systems and SBOMs

    Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.

    Stars
    13k
    Forks
    920
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/trivy