Trivy

Trivy is ranked #19 of 64 in software composition analysis software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

Trivy plans and pricing

All plans

Trivy Free Apache-2.0 licensed open-source scanner trivy.dev · 4 Oct 2026

Compared on software composition analysis software

Free plan: Yes

Best Trivy alternatives

See all 12

Snyk Open Source Free plan apiLinuxMacWebWin

$25/mo6.7 Sonatype Nexus Repository Free plan apiLinuxMacself-hostedWeb

$162.50/mo6.7 Accessibility Test Framework for Android Free plan AndroidLinuxMacWin

Free6.6 Docker Desktop Free plan LinuxMacWebWin

$9/mo6.6 Endor Labs Free plan apiLinuxMacWebWin

Free6.6 Socket Free plan apiextensionLinuxMacself-hosted

$25/mo6.6

Trivy

Purpose: Trivy scans code repositories, binary artifacts, container images, and Kubernetes clusters for vulnerabilities and misconfigurations.
License: The Trivy homepage identifies the project as Go software under the Apache-2.0 License.
Vulnerability scanning: Trivy detects known vulnerabilities in OS packages, language-specific packages, non-packaged software, and Kubernetes components.
Secrets scanning: Trivy includes a secret scanner.
IaC scanning: Trivy provides infrastructure-as-code misconfiguration scanning.
SBOM: Trivy supports generating software bills of materials (SBOMs).
Install options: Official installation options include container images, GitHub release binaries, package repositories, Homebrew, and Windows downloads.
CI integrations: The docs list official Azure DevOps and GitHub Actions integrations, alongside community integrations for other CI systems.
IDE integrations: The ecosystem docs list a VS Code plugin among Trivy integrations.
Deployment: Aqua says Trivy can be installed as a binary for CI/CD and does not require middleware or database dependencies.
Air-gapped use: Aqua says Trivy can run in air-gapped environments.
Output formats: Aqua says Trivy can export results in formats including JUnit XML, SARIF, and AWS Security Finding Format (ASFF).
Coverage limit: The vulnerability scanner documentation says Trivy does not support third-party or self-compiled packages and binaries.
Company: Aqua Security says it was founded in 2015 and is headquartered in Boston and Ramat Gan, Israel.
Price from: Free

Visit site Alternatives

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#19 of 64
Best Container Image Scanning Tools in 2026#7 of 27
Best Container Security Software in 2026#7 of 24
Best Cloud Vulnerability Scanners in 2026#14 of 24
Best Infrastructure as Code Security Software in 2026#15 of 22

Is Trivy yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Trivy

Sources

trivy.dev· checked 4 Oct 2026
trivy.dev/docs/latest/scanner/vulnerability/· checked 4 Oct 2026
trivy.dev/docs/latest/scanner/secret/· checked 4 Oct 2026
aquasec.com/products/trivy/· checked 4 Oct 2026
trivy.dev/docs/latest/guide/supply-chain/sbom/· checked 4 Oct 2026
trivy.dev/docs/v0.70/getting-started/installation· checked 4 Oct 2026
trivy.dev/docs/latest/ecosystem/cicd/· checked 4 Oct 2026
trivy.dev/docs/latest/ecosystem/ide/· checked 4 Oct 2026
aquasec.com/about-us/· checked 4 Oct 2026
trivy.dev/docs/latest/references/terminology/· checked 4 Oct 2026
trivy.dev/docs/latest/scanner/misconfiguration/· checked 4 Oct 2026
trivy.dev/docs/dev/ecosystem/prod/· checked 4 Oct 2026