Trivy

What it is

Trivy is a unified security scanner from Aqua Security that consolidates what used to be four or five separate tools: vulnerability scanning (OS packages and language dependencies), SBOM generation, misconfiguration detection (Terraform, CloudFormation, Kubernetes manifests, Dockerfiles), secret detection, and license compliance checks. It scans container images, filesystems, git repositories, running Kubernetes clusters, and VM images. Output formats include table, JSON, SARIF, and CycloneDX/SPDX for SBOM. It runs as a CLI binary, a container, or a Kubernetes operator (Trivy Operator) that continuously scans workloads in-cluster.

The pitch is consolidation: instead of running Grype for CVEs, Checkov for IaC misconfig, gitleaks for secrets, and Syft for SBOM, you run one tool with one config format and one output schema.

Who builds it and why

Built and maintained by Aqua Security, a commercial container security vendor. Trivy is their open-source on-ramp — free scanning drives adoption, and Aqua's paid platform (Aqua Enterprise) sits on top with runtime protection, policy enforcement, and centralized fleet management. This is a standard open-core model, not a community-governed project in the CNCF sense. Aqua funds the majority of full-time maintainers, though the 535-contributor count shows real external engagement, particularly around new scanners and vulnerability DB sources.

Production readiness signal

36,663 GitHub stars and a commit as recent as 2026-07-01 indicate an actively maintained project with no signs of stagnation. 535 contributors is a healthy number for a scanner of this scope. Release cadence is fast — v0.72.0 puts it well past 70 minor releases, suggesting frequent iteration (a double-edged sign: active development, but also a project still moving fast enough that breaking changes and DB schema shifts happen between minor versions).

CNCF maturity is not publicly available — Trivy is not a CNCF project; it's vendor-owned. That matters for governance risk: roadmap and deprecation decisions rest with Aqua, not a neutral foundation. For a security tool this is worth weighing, since scanner accuracy and CVE database timeliness directly affect what vulnerabilities you catch or miss.

Apache-2.0 license, written in Go — consistent with the rest of the cloud-native scanning ecosystem (easy static binary distribution, good for CI pipelines and admission controllers).

Who should use this

• Platform teams who want one scanner in CI/CD instead of stitching together four tools with different config syntax and output schemas.
• Teams already running Kubernetes who want in-cluster continuous scanning via the Trivy Operator without deploying a separate agent per scanner type.
• Anyone needing SBOM generation as a compliance requirement (SPDX/CycloneDX) alongside vulnerability data, since generating both from the same scan avoids drift between the SBOM and the vuln report.
• Teams that want a scanner they can run entirely offline/air-gapped once the vulnerability DB is mirrored.

Who should NOT use this

• Teams that need best-in-class accuracy in a single domain — dedicated tools like Semgrep for SAST or Checkov for IaC-specific policy depth often catch more nuanced issues than Trivy's broader-but-shallower checks in each category.
• Organizations wary of vendor lock-in risk on a security-critical dependency — Trivy isn't CNCF-governed, so Aqua could change licensing terms, deprecate features in favor of the paid product, or shift focus without a neutral steering committee to appeal to.
• Shops needing enterprise support SLAs, RBAC-integrated dashboards, or fleet-wide policy enforcement out of the box — that's the paid Aqua product, not Trivy itself.
• Teams running extremely high-volume scanning where DB update frequency and rate-limiting on the public vulnerability DB (GHCR-hosted) becomes an operational bottleneck without self-hosting a mirror.

Alternatives

• Grype (Anchore) — narrower scope (vuln scanning only), often cited as faster and slightly more accurate on specific ecosystems, pairs with Syft for SBOM.
• Checkov (Bridgecrew/Palo Alto) — IaC-focused misconfiguration scanner with deeper policy coverage for Terraform/CloudFormation than Trivy's built-in checks.
• Snyk — commercial-first vulnerability and IaC scanner with stronger remediation guidance and a broader paid feature set, weaker free tier than Trivy.

Pricing

Fully open source under Apache-2.0 — no paywall on the scanner itself. Aqua Security sells a separate enterprise platform (Aqua Cloud Native Security) for teams wanting centralized management, runtime protection, and support contracts, but Trivy the tool remains free and unrestricted.