Trivy

7.1easy start · #11 of 65
in Software Composition Analysis Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

Trivy is ranked #11 of 65 in software composition analysis software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

Trivy plans and pricing

All plans

Trivy Free Apache-2.0 licensed open-source scanner trivy.dev · 4 Oct 2026

Compared on software composition analysis software

Free plan: Yes

Best Trivy alternatives

See all 12

Sonatype Nexus Repository 0 of 4 in the starter kit Lesson 18.0 Xygeni 0 of 4 in the starter kit Lesson 27.9 FOSSA 0 of 4 in the starter kit Lesson 37.7 Snyk Open Source 0 of 4 in the starter kit Lesson 47.4 Docker Desktop 0 of 4 in the starter kit Lesson 57.3 Socket 0 of 4 in the starter kit Lesson 67.3

The record

Purpose: Trivy scans code repositories, binary artifacts, container images, and Kubernetes clusters for vulnerabilities and misconfigurations.
License: The Trivy homepage identifies the project as Go software under the Apache-2.0 License.
Vulnerability scanning: Trivy detects known vulnerabilities in OS packages, language-specific packages, non-packaged software, and Kubernetes components.
Secrets scanning: Trivy includes a secret scanner.
IaC scanning: Trivy provides infrastructure-as-code misconfiguration scanning.
SBOM: Trivy supports generating software bills of materials (SBOMs).
Install options: Official installation options include container images, GitHub release binaries, package repositories, Homebrew, and Windows downloads.
CI integrations: The docs list official Azure DevOps and GitHub Actions integrations, alongside community integrations for other CI systems.
IDE integrations: The ecosystem docs list a VS Code plugin among Trivy integrations.
Deployment: Aqua says Trivy can be installed as a binary for CI/CD and does not require middleware or database dependencies.
Air-gapped use: Aqua says Trivy can run in air-gapped environments.
Output formats: Aqua says Trivy can export results in formats including JUnit XML, SARIF, and AWS Security Finding Format (ASFF).
Coverage limit: The vulnerability scanner documentation says Trivy does not support third-party or self-compiled packages and binaries.
Company: Aqua Security says it was founded in 2015 and is headquartered in Boston and Ramat Gan, Israel.
Price from: Free

Where it ranks on The Geeks Club

Best Software Composition Analysis Software in 2026#11 of 65
Best Container Image Scanning Tools in 2026#8 of 28
Best Cloud Vulnerability Scanners in 2026#9 of 24
Best Container Security Software in 2026#9 of 24
Best Infrastructure as Code Security Software in 2026#10 of 22

Is Trivy yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Trivy

Sources

trivy.dev· checked 4 Oct 2026
trivy.dev/docs/latest/scanner/vulnerability/· checked 4 Oct 2026
trivy.dev/docs/latest/scanner/secret/· checked 4 Oct 2026
aquasec.com/products/trivy/· checked 4 Oct 2026
trivy.dev/docs/latest/guide/supply-chain/sbom/· checked 4 Oct 2026
trivy.dev/docs/v0.70/getting-started/installation· checked 4 Oct 2026
trivy.dev/docs/latest/ecosystem/cicd/· checked 4 Oct 2026
trivy.dev/docs/latest/ecosystem/ide/· checked 4 Oct 2026
aquasec.com/about-us/· checked 4 Oct 2026
trivy.dev/docs/latest/references/terminology/· checked 4 Oct 2026
trivy.dev/docs/latest/scanner/misconfiguration/· checked 4 Oct 2026
trivy.dev/docs/dev/ecosystem/prod/· checked 4 Oct 2026