Trivy is Aqua Security's widely adopted open source scanner for vulnerabilities, misconfigurations, secrets, and software bill of materials.
Trivy scans container images, filesystems, repositories, and cloud environments for vulnerabilities, exposed secrets, and configuration issues, and generates software bills of materials.
Aqua maintains Trivy as its primary open source project and offers a premium version integrated into the Aqua Platform.
Docker
Docker Scout
docker.com
Anchore
Grype
anchore.com
OSV-Scanner
google.com
Snyk
Snyk Open Source
snyk.io
| Attribute | Trivy | Docker Scout | Grype | OSV-Scanner | Snyk Open Source | |
|---|---|---|---|---|---|---|
| Provider | | | | | | |
| Founded | 2015 | 2013 | 2016 | 1998 | 2015 | |
| Sells To | Enterprise | B2B, Enterprise, Small Business | Enterprise | Enterprises, Individuals | Enterprise | |
| Pricing Model | Usage-based by workloads or repos | Recurring, Software, Subscription | Recurring, Software | Advertising, Subscription | Recurring, Software | |
| Ownership | Private | Public | Equity, Venture-backed | Subsidiary | Venture-backed |
Provider
Founded 2015
Sells To Enterprise
Pricing Model Usage-based by workloads or repos
Ownership Private
Provider
Founded 2013
Sells To B2B, Enterprise, Small Business
Pricing Model Recurring, Software, Subscription
Ownership Public
Provider
Founded 2016
Sells To Enterprise
Pricing Model Recurring, Software
Ownership Equity, Venture-backed
Provider
Founded 1998
Sells To Enterprises, Individuals
Pricing Model Advertising, Subscription
Ownership Subsidiary
Provider
Founded 2015
Sells To Enterprise
Pricing Model Recurring, Software
Ownership Venture-backed
Platform generating SBOMs and scanning containers for software supply chain security.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
Azure Container Registry is a fully managed registry for Docker and OCI container images and artifacts.
Snyk Agent Scan is an open-source scanner that checks AI agents, MCP servers, and skills for security issues.
AI security agent that hunts intent-based vulnerabilities such as broken access control and business logic flaws.
Platform generating SBOMs to expose software supply chain vulnerabilities.
Automated DAST scanner for web applications and APIs with CI/CD integration.
Vanta TPRM delivers continuous vendor risk monitoring, automated questionnaires, and proactive attack surface visibility for 50% faster reviews.
Nebu Code Security continuously scans codebases and pull requests to surface verified vulnerabilities with merge-ready fixes.
Platform generating SBOMs and scanning containers for software supply chain security.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
Azure Container Registry is a fully managed registry for Docker and OCI container images and artifacts.
Snyk Agent Scan is an open-source scanner that checks AI agents, MCP servers, and skills for security issues.
AI security agent that hunts intent-based vulnerabilities such as broken access control and business logic flaws.
Platform generating SBOMs to expose software supply chain vulnerabilities.
Automated DAST scanner for web applications and APIs with CI/CD integration.
Vanta TPRM delivers continuous vendor risk monitoring, automated questionnaires, and proactive attack surface visibility for 50% faster reviews.
Nebu Code Security continuously scans codebases and pull requests to surface verified vulnerabilities with merge-ready fixes.