Grypevs
Trivy
Trivy: Broader scanning in one tool, including misconfiguration and secrets
Grype
Vulnerability scanner for container images and filesystems
As of 29 August 2026, Grype is free to use. Anchore’s scanner, paired with Syft for SBOM generation. Softwr lists it under Cybersecurity. Grype is made by Anchore, available on Linux, macOS, Windows, Self-hosted.
Overview
What Grype does
Grype is an open-source vulnerability scanner for container images and filesystems from Anchore. It pairs with Syft, Anchore’s software bill of materials generator: Syft catalogues what is in an image, Grype matches that inventory against vulnerability data. That separation is the design point. An SBOM produced once can be scanned repeatedly as new vulnerabilities are published, without re-analysing the image — which matters when the question is not "was this safe at build time" but "is it safe today".
What people use it for
- Re-scanning stored SBOMs as new CVEs are published, without rebuilding images
- Failing CI when a build introduces a known vulnerability
- Auditing what is actually installed inside a third-party image
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Grype.
- Depends on public vulnerability databases, so coverage and false positives vary by ecosystem
- No triage, exception tracking or reporting UI — that is Anchore’s commercial product
- Overlaps heavily with Trivy, and most teams pick one rather than running both
Cross-shopped
What people choose instead of Grype
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
- GrypevsSnyk
Snyk: Commercial scanning with triage, fix pull requests and reporting
Pricing
What Grype costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Grype
Free
- Full functionality
- No usage limits
- Community support
Capabilities
Features
Image and filesystem scanning
Containers, directories and archives
SBOM-driven
Scans a Syft SBOM directly, so inventory and matching are separate steps
Wide ecosystem coverage
OS packages plus most major language dependency formats
Pipeline friendly
Single binary with exit codes and machine-readable output
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Is Grype free?
Yes, open source from Anchore. Anchore Enterprise is the paid platform around it.
What is the difference between Grype and Syft?
Syft generates the software bill of materials; Grype matches that inventory against vulnerability data. They are designed to be used together.
Grype or Trivy?
They cover similar ground. Trivy is broader out of the box, including misconfiguration and secret scanning; Grype pairs more cleanly with an SBOM-first workflow.
Keep looking
Where to go from Grype
- Grype alternativesEvery product people weigh against it
- Grype pricingPlans, floors and what the tiers exclude
- Grype badgesWhich rules it meets, and the figure behind each
- All Cybersecurity softwareThe full category
- Best Cybersecurity softwareThe shortlist, and how it was cut
Best Cybersecurity software for
Compare Grype with
- Trivy
- Snyk
- Semgrep
- Chainguard
- HashiCorp Vault
- Bitwarden
- Infisical
- Authelia
- Ory Kratos
- OWASP ZAP
- Cosign
- authentik
- Socket
- Socure
- SonicWall
- Sophos Intercept X
- Splunk Enterprise Security
- Sticky Password
Other Cybersecurity software
Open-source static analysis tool for finding security bugs and enforcing code standards.
Free, then $30/mo10 researched notesSecure-by-default open source software with hardened container images and libraries
Free, then $19,000/yr11 researched notesOpen-source authentication and two-factor portal for reverse proxies
Open source9 researched notesFree, open-source web application scanner and intercepting proxy, now governed by the Software Security Project.
Free plan14 researched notesSigns and verifies container images and artifacts, with or without managing keys
Open source12 researched notesOpen-source identity provider with flexible authentication flows
Free plan9 researched notesSupply chain security platform detecting and blocking malicious dependencies
Free, then $25/mo11 researched notesPredictive identity verification and fraud scoring for the US market
Pricing on request11 researched notesProven security, performance and simplicity for modern networks
Pricing on request8 researched notesPassword manager with autofill, digital wallet, and dark web monitoring
Free, then $2.5/mo6 researched notes
Softwr does not host reviews and shows no star rating for Grype, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Grype
Grype alternatives
What people switch to, and what they give up
Grype pricing
Every tier, and where the cost actually lands
Compare Grype
Put it head to head with anything we hold
Grype badge
Its rating, and an embed for your own site
Best Cybersecurity software alternatives
Large Chinese video platform that US federal buyers and federal contractors cannot lawfully use
quote
Managed video loss prevention with human auditors for restaurants, convenience stores and retail
quote
Workforce and customer authentication from a certificate authority
Per user per month
Privileged access management, endpoint privilege management and secure remote access
quote
Cloud video surveillance billed per camera per month, where retention length drives the bill more than anything else
Per camera per month
AI video search that runs on cameras you already own, starting near five dollars per camera per month
Per camera per month
Phishing-resistant passwordless authentication with device trust enforced at every login
quote