CheckOps home

Tools directory

T

CheckOps

Trivy

Trivy is Aqua Security's Apache-2.0 all-in-one scanner for container images, filesystems, Git repos, VM images and Kubernetes, finding CVEs, IaC misconfigurations, secrets, licences and SBOM data.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Trivy is a comprehensive and versatile security scanner from Aqua Security, licensed Apache-2.0, with about 39,000 GitHub stars. Its README describes two ideas: targets (what Trivy can scan) and scanners (what it can find there).

Targets include container images, filesystems, remote Git repositories, virtual machine images and Kubernetes. Scanners find OS packages and software dependencies (SBOM), known vulnerabilities (CVEs), infrastructure-as-code issues and misconfigurations, sensitive information and secrets, and software licences.

This breadth is why Trivy shows up in so many pipelines: one binary can replace several single-purpose scanners. The former tfsec project now points users to Trivy for Terraform scanning.

In the quality loop, Trivy runs in CI on every image build and pull request, and can also run continuously in a cluster through the Trivy Operator.

Features

  1. Container image scanning: OS packages and language dependencies inside images.
  2. Filesystem and repo scanning: Scan a project directory or a remote Git repository.
  3. Kubernetes scanning: Scan clusters for vulnerabilities and misconfigurations.
  4. IaC misconfiguration: Terraform, CloudFormation, Kubernetes manifests, Dockerfiles and more.
  5. Secret detection: Finds hard-coded credentials.
  6. Licence scanning: Reports software licences of dependencies.
  7. SBOM: Generate and scan SBOMs (CycloneDX and SPDX).
  8. Easy install: Homebrew, Docker image, binaries and CI integrations.

Pros

  1. All-in-one: Vulnerabilities, misconfigurations, secrets and licences in one tool.
  2. Free: Apache-2.0.
  3. Fast and simple: Single binary with sensible defaults.
  4. Huge adoption: Large community and many integrations.
  5. Actively maintained: Commits in November 2026.

Cons

  1. Noise: Base-image CVEs can produce long lists that need filtering and ignore files.
  2. Database downloads: Needs vulnerability database updates; air-gapped use needs extra setup.
  3. Breadth over depth: Specialised tools may go deeper in a single area.
  4. Policy tuning: IaC checks need tuning to match your standards.
  5. No SAST: It does not analyse your own source code for logic flaws.

Scan an image and fail the build on serious findings:

trivy image --severity HIGH,CRITICAL --exit-code 1 python:3.12-slim

Scan a repository for vulnerabilities, misconfigurations and secrets:

trivy fs --scanners vuln,misconfig,secret .

Generate an SBOM:

trivy image --format cyclonedx --output sbom.json myapp:latest

Tips: use .trivyignore for accepted risks with comments explaining why, pin the Trivy version in CI, and cache the vulnerability database between runs.

Resources:

Pricing

Trivy is free and open source under Apache-2.0. Aqua Security sells a commercial platform; see Aqua’s site for that.

  1. DevOps and platform teams scanning images and IaC in CI.
  2. Teams wanting one scanner instead of several.
  3. Kubernetes operators checking clusters.
  4. Not a fit as your only SAST; pair with CodeQL or Semgrep.

Conclusion

Trivy is the most versatile free scanner for containers, IaC, secrets and dependencies.

Add it early in the pipeline, tune severity thresholds and ignore files, and pair it with SAST for your own code.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Trivy side by side.