Grype is an open source vulnerability scanner for containers, source directories, and filesystems with software bill of materials integration.
Grype is an open source scanner that checks container images, source directories, and filesystems for known vulnerabilities.
It consumes software bills of materials produced by Syft, fitting vulnerability checks into local and continuous integration workflows.
| Attribute | Grype | Docker Scout | Trivy | |
|---|---|---|---|---|
| Provider | |  |  | |
| Founded | 2016 | 2013 | 2015 | |
| Sells To | Enterprise | B2B, Enterprise, Small Business | Enterprise | |
| Pricing Model | Recurring, Software | Recurring, Software, Subscription | Usage-based by workloads or repos | |
| Ownership | Equity, Venture-backed | Public | Private |
Provider
Founded 2016
Sells To Enterprise
Pricing Model Recurring, Software
Ownership Equity, Venture-backed
Provider
Founded 2013
Sells To B2B, Enterprise, Small Business
Pricing Model Recurring, Software, Subscription
Ownership Public
Provider
Founded 2015
Sells To Enterprise
Pricing Model Usage-based by workloads or repos
Ownership Private
OSV-Scanner is an open source command-line scanner that checks project dependencies for known vulnerabilities against the OSV database.
Snyk Open Source scans open source dependencies for vulnerabilities through CLIs, IDEs, pull requests, and CI/CD pipelines.
Aqua Container Security protects containers across all platforms and clouds from build through runtime.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
GitHub Packages hosts software packages inside GitHub repositories with integrated permissions and workflows.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
Aqua Software Supply Chain Security protects code, tools, and processes against supply chain attacks and AI-specific risks before production.
SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
AI security agent that hunts intent-based vulnerabilities such as broken access control and business logic flaws.
Vortex MCP runs exploit-checked dynamic application tests from developer MCP clients before commit.
Prisma Cloud combines cloud security posture management with agentless workload scanning across AWS, Azure, and Google Cloud deployments.
OSV-Scanner is an open source command-line scanner that checks project dependencies for known vulnerabilities against the OSV database.
Snyk Open Source scans open source dependencies for vulnerabilities through CLIs, IDEs, pull requests, and CI/CD pipelines.
Aqua Container Security protects containers across all platforms and clouds from build through runtime.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
GitHub Packages hosts software packages inside GitHub repositories with integrated permissions and workflows.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
Aqua Software Supply Chain Security protects code, tools, and processes against supply chain attacks and AI-specific risks before production.
SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
AI security agent that hunts intent-based vulnerabilities such as broken access control and business logic flaws.
Vortex MCP runs exploit-checked dynamic application tests from developer MCP clients before commit.
Prisma Cloud combines cloud security posture management with agentless workload scanning across AWS, Azure, and Google Cloud deployments.