Trivy
Trivy: A broad free scanner for container and infrastructure coverage, without reachability analysis. Ranked #26 of 65 in Software Composition Analysis Software by our editors (6.7/10); pricing: Free plan; best for container and infrastructure scanning users.
At a glance
- Editor score6.7 / 10
- PricingFree plan
- Best forContainer and infrastructure scanning users
- Free planYes
- Paid fromFree
- SBOM generationYes
- Founded2015 · Boston, Massachusetts, and Ramat Gan, Israel
- Facts checked22 Sep 2026
Where it wins
- Scans packages, containers, filesystems, Kubernetes, virtual machines, and repositories
- Generates CycloneDX and SPDX SBOMs with document scanning support
- Covers licenses, IaC misconfigurations, secrets, VEX, and vulnerability suppression
Where it doesn't
- Does not provide reachability analysis
- Primarily delivered as a command-line tool
- Self-hosted deployment requires teams to manage the scanning environment
Our verdict on Trivy
Trivy is an open-source security scanner maintained by Aqua Security for teams that need broad coverage across software packages, container images, code repositories, binary artifacts, virtual-machine images, filesystems, root filesystems, and Kubernetes environments. It supports operating-system packages and ecosystems including Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, and Julia. The tool runs on Windows, macOS, and Linux, and is primarily delivered as a command-line tool that can be installed locally or run as a container.
Its strongest differentiator is breadth. Trivy combines vulnerability scanning with license scanning, infrastructure-as-code misconfiguration scanning, secrets scanning, SBOM generation, SBOM document scanning, VEX support, and vulnerability suppression. Published capabilities include CycloneDX and SPDX SBOM formats, pull request scanning, and CI/CD integration through GitHub Actions and Azure DevOps. Kubernetes is supported both as a scanning target and as an integration point, making Trivy a practical fit for teams that want one open-source tool across application, image, infrastructure, and cluster workflows.
The trade-off is depth in specific analysis areas. Trivy does not provide reachability analysis, which matters to teams prioritizing whether vulnerable code paths are actually reachable. Its self-hosted model and command-line delivery also suit engineering teams comfortable incorporating scanning into their own environments and pipelines. Choose Trivy when free, open-source coverage across containers, infrastructure, packages, SBOMs, licenses, secrets, and IaC is the priority. Consider a different option when reachability analysis is required or when a managed scanning service is preferred.
Your product? Our editors can test Trivy in depth and publish a review, labelled as paid · from $149/mo →
Trivy pricing
Trivy fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported ecosystems | Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packages |
| SBOM generation | Yes |
| Reachability analysis | Not verified |
| Pull request scanning | Not verified |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 6 integrations: GitHub Actions, Kubernetes, Harbor, Visual Studio Code, JetBrains IDEs, Kubernetes Lens See all → |
| Pricing | Free plan |
| Website | trivy.dev |
| Facts checked | 22 Sep 2026 |
Trivy integrations
Trivy lists 6 integrations on its own site.
- GitHub Actions
- Kubernetes
- Harbor
- Visual Studio Code
- JetBrains IDEs
- Kubernetes Lens
Alternatives to Trivy
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
Also Ranked In
Trivy is ranked in 7 of our directories.
Used Trivy? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Trivy for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Trivy is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/trivy/"><img src="https://www.itechguides.com/best/badge/trivy.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update