Trivyvs
Snyk
Snyk: Commercial scanning with triage workflow, fix pull requests and reporting that Trivy leaves to you
Trivy
Open-source vulnerability and misconfiguration scanner
As of 29 August 2026, Trivy is free to use. Aqua’s scanner for containers, filesystems and IaC. Softwr lists it under Cybersecurity. Trivy is made by Aqua Security, available on Linux, macOS, Windows, Self-hosted.
Overview
What Trivy does
Trivy is an open-source security scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licence issues across container images, filesystems, Git repositories, Kubernetes clusters and infrastructure-as-code. Its adoption owes as much to packaging as detection: a single binary with no server to run, sensible defaults, and a scan that completes fast enough to sit in a pull request check. That is why it became a common default in CI pipelines rather than a security-team-only tool.
What people use it for
- Failing a pull request when a container image introduces a known CVE
- Scanning Terraform and Kubernetes manifests for misconfiguration before apply
- Catching committed secrets as part of an existing CI step
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Trivy.
- Reports what public advisory databases know, so coverage varies by ecosystem and unfixed CVEs create noise
- No built-in triage or exception workflow, so suppressing accepted risk is managed in config files
- Findings are point-in-time from CI, with no continuous runtime monitoring unless you add the commercial platform
Cross-shopped
What people choose instead of Trivy
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
Pricing
What Trivy costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Trivy
Free
- Full scanner
- Unlimited scans
- Community support
Capabilities
Features
Multi-target scanning
Container images, filesystems, repositories, Kubernetes and IaC
Vulnerability detection
OS packages and language dependencies against public advisory databases
Misconfiguration checks
Terraform, Kubernetes and Dockerfile policy scanning
Secret detection
Finds committed credentials during the same scan
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Is Trivy free?
Yes, open source from Aqua Security with no licence fee. Aqua sells a commercial platform around it.
What can Trivy scan?
Container images, filesystems, Git repositories, Kubernetes clusters and infrastructure-as-code, for vulnerabilities, misconfigurations, secrets and licences.
Does Trivy need a server?
No. It is a single binary, which is a large part of why it became a default in CI.
Keep looking
Where to go from Trivy
- Trivy alternativesEvery product people weigh against it
- Trivy pricingPlans, floors and what the tiers exclude
- Trivy badgesWhich rules it meets, and the figure behind each
- All Cybersecurity softwareThe full category
- Best Cybersecurity softwareThe shortlist, and how it was cut
Best Cybersecurity software for
Compare Trivy with
- Grype
- Snyk
- Chainguard
- Semgrep
- Bitwarden
- Infisical
- Authelia
- Ory Kratos
- HashiCorp Vault
- Arnica
- OWASP ZAP
- Proton Mail
- Veriff
- Brave Browser
- March Networks
- Salient CompleteView
- Sumsub
- Syft
Other Cybersecurity software
Secure-by-default open source software with hardened container images and libraries
Free, then $19,000/yr11 researched notesOpen-source static analysis tool for finding security bugs and enforcing code standards.
Free, then $30/mo10 researched notesOpen-source authentication and two-factor portal for reverse proxies
Open source9 researched notesAI-native application security platform detecting and fixing vulnerabilities across the SDLC
Free, then $300/yr11 researched notesFree, open-source web application scanner and intercepting proxy, now governed by the Software Security Project.
Free plan14 researched notesDocument and biometric identity verification with published per-check pricing
From $0.8/verification11 researched notesBanking and retail video with transaction overlay, sold by a Canadian firm that changed from Chinese to Taiwanese ownership
Pricing on request12 researched notesPer-camera licensed video management software with unlimited client workstations
Pricing on request12 researched notesIdentity verification and AML screening priced per verification
From $1.35/verification10 researched notesGenerates a software bill of materials from images, filesystems and archives
Open source12 researched notes
Softwr does not host reviews and shows no star rating for Trivy, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Trivy
Trivy alternatives
What people switch to, and what they give up
Trivy pricing
Every tier, and where the cost actually lands
Compare Trivy
Put it head to head with anything we hold
Trivy badge
Its rating, and an embed for your own site
Best Cybersecurity software alternatives
Large Chinese video platform that US federal buyers and federal contractors cannot lawfully use
quote
Managed video loss prevention with human auditors for restaurants, convenience stores and retail
quote
Workforce and customer authentication from a certificate authority
Per user per month
Privileged access management, endpoint privilege management and secure remote access
quote
Cloud video surveillance billed per camera per month, where retention length drives the bill more than anything else
Per camera per month
AI video search that runs on cameras you already own, starting near five dollars per camera per month
Per camera per month
Phishing-resistant passwordless authentication with device trust enforced at every login
quote