trivy

Trivy is the swiss-army scanner for supply chain security: it finds vulnerabilities in your container images, code dependencies, and infrastructure-as-code, generates SBOMs, and hunts for leaked secrets, all from one fast binary. Where Grype and Syft split scanning and SBOM generation into two tools, Trivy does the whole job together. Open source, from Aqua Security, free.

It's a single Go binary that runs anywhere: your laptop, CI, or a Kubernetes operator. Point it at an image, a filesystem, a git repo, or a Terraform directory, and it tells you what's vulnerable and what's misconfigured. That breadth is the appeal, one tool instead of five, which is why Trivy became the default scanner baked into a lot of registries and CI pipelines.

Trivy is free and open source. Aqua, the company behind it, sells the Aqua Platform: a commercial layer with centralized findings, policy enforcement, runtime protection, and support. Solo and small teams, the CLI does everything you need. Larger orgs that want a managed view and governance across many images and clusters, the platform is the paid step up.

The catch: doing everything means it's a mile wide. For any single job, a focused tool can go deeper, a dedicated SBOM generator, a dedicated IaC scanner, a dedicated secret scanner. And like every vulnerability scanner it's noisy, so a first scan of a common base image surfaces a pile of CVEs you'll need to triage. Trivy's value is coverage in one binary, not being the deepest at any one thing.