Trivy

Trivy is a free, Apache-2.0-licensed scanner for code repositories, binary artifacts, container images, and Kubernetes clusters. It checks for known vulnerabilities, infrastructure-as-code misconfigurations, secrets, and license issues, and it can generate software bills of materials. Vulnerability detection covers operating-system and language-specific packages, some non-packaged software, and Kubernetes components. Its supported ecosystems include Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packages. Configuration checks cover Docker, Kubernetes, Terraform, and CloudFormation files, and users can write custom checks. Trivy can run as a binary in CI/CD without middleware or database dependencies, and it can operate in air-gapped environments. Official integrations include Azure DevOps and GitHub Actions; the ecosystem also lists a VS Code plugin. Results can be exported in formats including JUnit XML, SARIF, and ASFF. Installation options include container images, release binaries, package repositories, Homebrew, and Windows downloads. The vulnerability scanner does not support third-party or self-compiled packages and binaries, and may skip third-party packages.

Trivy covers several kinds of software security checks and supports multiple installation and CI options. Its vulnerability coverage has limits for third-party and self-compiled packages.

Trivy suits teams and developers who need to scan code, artifacts, container images, or Kubernetes environments. It can also fit CI/CD workflows and air-gapped environments.

Trivy is a free, open-source security scanner for software packages, repositories, artifacts, containers, and Kubernetes environments. It best suits development and security teams that want several kinds of checks in self-hosted or CI workflows. Its broad scanning scope and flexible deployment are strong advantages, but package blind spots and unsandboxed plugins warrant a careful rollout.

Overview

Trivy brings vulnerability, misconfiguration, secret, and license scanning together with software bill of materials (SBOM) generation. It can scan code repositories, binary artifacts, container images, and Kubernetes clusters, so it can cover more of a delivery workflow than a container-only scanner. It also maintains the security databases needed for scans automatically, reducing manual upkeep.

The Go project is licensed under Apache-2.0. It can run as a CI/CD binary without middleware or database dependencies and supports air-gapped environments. Those traits make it a practical fit for teams that need scanning inside controlled infrastructure rather than a hosted service.

Key features

Scanning and reporting

Trivy detects known vulnerabilities in operating-system and language-specific packages, some non-packaged software, and Kubernetes components. Its IaC checks cover Docker, Kubernetes, Terraform, and CloudFormation files, with custom checks also supported. SBOM generation and exports such as JUnit XML, SARIF, and AWS Security Finding Format help route results into reporting and security processes.

Coverage has meaningful boundaries: Trivy does not support third-party or self-compiled packages and binaries, and its focus on official operating-system vendor packages means some third-party packages may be skipped. Teams relying on internally built or externally sourced components should not treat its results as a complete inventory of vulnerabilities.

Integrations and deployment

Official integrations include a GitHub Action and an Azure DevOps Pipelines Task, and the ecosystem includes a VS Code plugin. The core team develops and supports official integrations; community integrations do not carry the same assurance of security or maintenance. Trivy Operator can continuously scan Kubernetes workloads and the cluster, a useful option for teams that want recurring cluster checks rather than only pipeline scans.

Installation options include container images, release binaries, package repositories, Homebrew, and Windows downloads. Official platform options cover Linux, macOS, Windows, and FreeBSD. Plugins need particular caution: they run with the user's permissions, are not sandboxed, and public plugins are not audited for security.

Pricing

Trivy: free. The Apache-2.0-licensed scanner is free to use, with no free trial or paid tier identified. That makes it accessible for individual developers and teams, but the free price does not remove the need to validate coverage or assess plugin risk.

Platforms

Trivy supports Linux, macOS, Windows, and FreeBSD installation options, as well as an official container image and self-hosted deployment. Teams can choose binaries or package-based installation for local and CI use, or run it in a container. Its air-gapped support is especially relevant to isolated environments.

Who it's for

Trivy is a strong choice for teams seeking one open-source tool for vulnerability, secret, license, and infrastructure-configuration checks, particularly when they need self-hosting, CI integration, or air-gapped operation. It is less suitable as the sole vulnerability control for environments that depend heavily on third-party or self-compiled packages, or for teams that cannot govern the use of unsandboxed plugins.

Pros and cons

• Pros: Free under Apache-2.0, with no trial barrier, makes broad scanning accessible without a software license cost.
• Pros: Vulnerability, misconfiguration, secret, and license scanners plus SBOM generation cover several security tasks in one tool.
• Pros: Binary deployment without middleware, automatic database maintenance, and air-gapped support suit controlled or isolated infrastructure.
• Pros: Official GitHub Actions and Azure DevOps integrations give teams supported paths into two common CI workflows.
• Cons: Third-party and self-compiled packages and binaries are outside supported vulnerability coverage, limiting confidence for mixed or custom-built inventories.
• Cons: Plugins run unsandboxed with user permissions, and public plugins are not security-audited.
• Cons: Community integrations are not guaranteed to be secure or maintained, unlike those supported by the core team.

Alternatives

For a broader choice among cloud-focused vulnerability tools, browse Cloud Vulnerability Scanners. For container-image-specific options, see Container Image Scanning Tools or Container Security Software. Teams prioritizing IaC checks can compare Infrastructure as Code Security Software, while software dependency analysis is covered by Software Composition Analysis Software.

• Cy5 Cloud-Native Vulnerability Management is a paid web option with a free plan and trial; choose it if a web-based cloud vulnerability management product is a better fit.
• Intruder offers a free tier with five infrastructure targets, weekly external scans, and one connected cloud account; choose it when those defined limits fit the scanning need.
• Kubescape is a free, self-hosted open-source CLI and Kubernetes operator; choose it when that Kubernetes-centered toolset is the priority.
• Mondoo CSPM has free open-source tools for cloud, Kubernetes, OS, SaaS, and API scanning, plus a Kubernetes operator; choose it for that mix of asset types and its extensible provider system.
• Prowler Cloud offers a 15-day free trial with every check and compliance framework, as well as a free open-source plan; choose it when a trial of compliance checks is useful.
• Qualys TotalCloud has a free license with limited API calls for control evaluation and a paid platform subscription; choose it when Qualys's cloud platform subscription is the intended fit.
• RapidFort provides five curated near-zero-CVE images from a limited catalog with daily rebuilds and patching on its free plan; choose it when ready-to-use patched container images matter more than scanning breadth.
• ZeusCloud offers a free, self-hosted open-source option and a cloud-hosted enterprise license with user management and advanced attack path analysis; choose it when those cloud-hosted enterprise capabilities are needed.

Verdict

Choose Trivy if you want a no-cost, self-hosted scanner that spans vulnerabilities, configuration, secrets, licenses, and SBOMs across developer and Kubernetes workflows. Its deployment flexibility is compelling; look elsewhere or add complementary coverage if third-party and self-compiled packages are central to your software inventory, and restrict plugins because they are not sandboxed.