Trivy is the reference open source security scanner for the software supply chain. On its own, it covers vulnerabilities, Infrastructure as Code, secrets, licenses, SBOMs and Kubernetes.
Maintained by Aqua Security under the Apache 2.0 license, Trivy consolidates into a single binary what previously required three or four separate scanners. It scans container images, filesystems, Git repositories and Kubernetes clusters through four engines: vulnerabilities (CVEs), IaC misconfigurations (Terraform, Helm, Dockerfile, Ansible, etc.), plaintext secrets and licenses. It can also generate and consume SBOMs in CycloneDX and SPDX formats.
It is the most widely adopted open source scanner in its ecosystem, with around 36,000 GitHub stars, twice as many as Grype, and very regular releases. More importantly, it has become the default scanner for tools we already use: Harbor, GitLab Container Scanning (replacing Clair) and Artifact Hub rely on it natively, and it is among the Red Hat certified scanners. The core remains open source with no crippled features. Aqua separately sells a commercial platform that reuses the same engine for enterprise needs (centralized interface, commercial feeds, CSPM, runtime protection).
Its main limitation stems from its positioning: breadth over depth. On any given domain, specialized tools go further (Checkov for graph-based IaC analysis, Grype for vulnerability prioritization via EPSS/KEV), and managing false positives at scale requires some investment in pipelines. This remains marginal compared to the coverage obtained out of the box, with no tool assembly required.
Our take:
Trivy is the first scanning tool to put in place, and for most needs it is enough. Free and already integrated by default into a good part of our tooling, we recommend it without reservation as the foundation for supply chain security.
