Supply Chain Security

trivy36.7k★

Trivy is the swiss-army scanner for supply chain security: it finds vulnerabilities in your container images, code dependencies, and infrastructure-as-code, generates SBOMs, and hunts for leaked secrets, all from one fast binary. Where Grype and Syft split scanning and SBOM generation into two tools, Trivy does the whole job together. Open source, from Aqua Security, free. It's a single Go binary that runs anywhere: your laptop, CI, or a Kubernetes operator. Point it at an image, a filesystem, a git repo, or a Terraform directory, and it tells you what's vulnerable and what's misconfigured. That breadth is the appeal, one tool instead of five, which is why Trivy became the default scanner baked into a lot of registries and CI pipelines. Trivy is free and open source. Aqua, the company behind it, sells the Aqua Platform: a commercial layer with centralized findings, policy enforcement, runtime protection, and support. Solo and small teams, the CLI does everything you need. Larger orgs that want a managed view and governance across many images and clusters, the platform is the paid step up. The catch: doing everything means it's a mile wide. For any single job, a focused tool can go deeper, a dedicated SBOM generator, a dedicated IaC scanner, a dedicated secret scanner. And like every vulnerability scanner it's noisy, so a first scan of a common base image surfaces a pile of CVEs you'll need to triage. Trivy's value is coverage in one binary, not being the deepest at any one thing.

grype12.5k★

Grype scans container images and filesystems for known vulnerabilities. Feed it an image or an SBOM from Syft, and it checks everything inside against vulnerability databases and tells you what is exploitable and how bad. Open source, free, and quick enough to run on every build. It's a single Go binary with no setup beyond the first database pull. Run it in CI to fail a build when a critical CVE shows up, or against a running image to audit what you've deployed. It reads Syft's SBOM output directly, so the two together give you inventory plus vulnerabilities in one pipeline. Grype and Syft are free. Anchore Enterprise is the paid platform on top, with centralized policy, historical tracking, and support for teams that need to prove compliance. Solo and small teams, the CLI in CI covers it. Larger orgs, the enterprise layer is about governance and audit trails, not better scanning. The catch: vulnerability scanners are noisy. A fresh scan of a common base image can surface dozens of CVEs, many unfixable or irrelevant to how you use the software. The work isn't running Grype, it's triaging what it finds without drowning in low-priority noise.