Free tools Windows power users keep installed
One-click scans. No signup required.
For most small development teams, start with Trivy. It covers dependencies, container images, and infrastructure as code from one low-friction CLI. Add OWASP ZAP when you run a web application that needs dynamic testing. Choose Grype with Syft for a fast, SBOM-first container or filesystem workflow; OSV-Scanner for OSV-backed lockfile, SBOM, and container checks; and OWASP Dependency-Check when Java or JVM builds dominate. Move to OWASP Dependency-Track when you need persistent SBOM monitoring and VEX decisions instead of isolated CI reports.
The short answer: choose by the layer you need to inspect
“Vulnerability scanner” describes several different jobs. Software composition analysis (SCA) examines third-party packages and lockfiles. Container scanners inspect the operating-system packages and application components inside images. Infrastructure-as-code (IaC) scanners look for insecure configuration before cloud resources are deployed. Dynamic application security testing (DAST) probes a running web application. Secret detection and static application security testing (SAST) inspect source code for different classes of risk. No single open-source tool is equally strong at every layer.
As an Amazon Associate I earn from qualifying purchases.
That is why the best small-team setup is usually a deliberately small stack rather than one supposedly universal product:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- One broad default: Trivy for dependencies, images, and IaC.
- One web layer: OWASP ZAP for a running web application.
- One focused alternative: Grype plus Syft when you want an SBOM-first, scriptable workflow.
- One ecosystem specialist: OSV-Scanner for OSV-backed lockfile and SBOM matching, or OWASP Dependency-Check for Java/JVM-heavy builds.
- One operating layer, when needed: OWASP Dependency-Track for continuous SBOM monitoring and VEX, or DefectDojo for aggregating findings from many scanners.
Open source removes a software-license charge, but it does not remove the work of updating databases, reviewing findings, assigning remediation, or maintaining a dashboard. Select the smallest combination that covers the inputs you actually ship.
#1 Best Overall
What each scanner layer sees
Dependencies and lockfiles (SCA)
SCA compares declared or resolved third-party components with vulnerability records. A lockfile gives a scanner an exact version graph, while a manifest alone may leave transitive versions less certain. This layer is where OSV-Scanner is particularly useful because it is backed by the OSV.dev database and scans lockfiles as well as SBOMs and container images. OWASP Dependency-Check is a long-established CVE scanner that fits naturally into Maven, Gradle, and other CI pipelines.
Dependency findings still require an engineering decision. A vulnerable package may be unreachable in a particular build, disabled by configuration, or already mitigated by a compensating control. Conversely, a clean dependency report does not prove that your own code, runtime configuration, or deployed endpoint is safe.
Container images
Container scanning examines image layers and the software installed in them. Trivy is the broadest low-friction starting point when the same team also needs dependency and IaC checks. Grype is designed specifically for container images and filesystems and is a strong choice when speed, scripting, and a clean separation between SBOM generation and vulnerability matching matter.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Infrastructure as code
IaC checks inspect templates and configuration before deployment. This is a different input from an image or lockfile: an image scanner cannot tell you that a cloud storage resource is exposed by a template, and an IaC scanner cannot tell you that an operating-system package inside an image is vulnerable. Trivy is the practical single-tool option in this group because its documented scope includes IaC alongside dependencies and images.
Running web applications (DAST)
DAST sends requests to a live application and observes responses. It can expose issues that package analysis cannot see, such as unsafe routes, authentication mistakes, or behavior caused by the interaction of several components. OWASP describes ZAP as “A full featured free and open source DAST tool that includes both automated scanning for vulnerabilities and tools to assist expert manual web app pen testing.” Use it against a test or staging deployment and pair it with SCA and container checks.
SBOM monitoring and vulnerability operations
An SBOM is an inventory, not a complete security program. A CI scanner can produce a report for one commit; a monitoring platform keeps component versions, affected releases, and decisions visible over time. Dependency-Track centralizes component vulnerability tracking from CycloneDX SBOMs, continuously monitors sources including NVD, GitHub Advisories, and OSV, and supports VEX decisions. DefectDojo serves a different purpose: it aggregates, deduplicates, and manages findings from more than 100 scanner formats.
Comparison of the leading open-source options
| Tool | Primary inputs | Why a small team chooses it | Important boundary | Best starting use |
|---|---|---|---|---|
| Trivy | Dependencies, container images, IaC | Broad coverage and easy setup from one CLI | Weaker reachability analysis than commercial alternatives | Polyglot repositories that build containers and use IaC |
| Grype with Syft | Container images and filesystems; SBOMs generated with Syft | Fast, scriptable, SBOM-first workflow | Its documented focus is narrower than Trivy’s all-in-one scope | Teams already producing SBOMs or wanting a small container/filesystem scanner |
| OSV-Scanner | Lockfiles, SBOMs, container images | OSV.dev-backed matching, guided remediation, and call analysis for some ecosystems | Call analysis is available only for some ecosystems | Repositories where lockfile and ecosystem-native matching are central |
| OWASP Dependency-Check | Project dependencies across many languages, especially JVM builds | Long-established CVE scanning and straightforward Maven or Gradle integration | Focused CI dependency scanner rather than a complete image, IaC, and web-testing stack | Java/JVM-heavy projects |
| OWASP ZAP | Running web applications | Automated DAST plus tools for expert manual testing | It does not replace dependency, image, or IaC scanning | Web applications with a test or staging environment |
| OWASP Dependency-Track | CycloneDX SBOMs and component vulnerability data | Persistent monitoring and VEX management | Requires operating a central service and supplying SBOMs | Teams that need ongoing component visibility beyond a CI job |
| DefectDojo | Findings from more than 100 scanner formats | Aggregation, deduplication, and workflow management | It organizes scanner output rather than replacing every underlying scanner | Teams running several scanners or needing a common findings queue |
The available tool descriptions do not establish a universal ranking for SARIF output, exact ecosystem lists, false-positive rates, or reachability coverage. Confirm those details in the release documentation for the versions you deploy. The meaningful comparison is the input each tool can inspect, how findings fit your CI process, and whether you need a persistent operating workflow.
Recommended Free Tools
Trivy: the practical default for a small polyglot team
OWASP calls Trivy an “all-in-one scanner for dependencies, images, and IaC” and highlights its breadth and ease of setup. That combination makes it the sensible first installation for a team that wants one command-line tool to cover the most common delivery artifacts.
Choose Trivy when
- Your repository contains several languages or package managers.
- You build container images as part of delivery.
- Your infrastructure is defined in templates that should be checked before deployment.
- You want to introduce scanning without first operating a central dashboard.
Understand its limitation
OWASP notes weaker reachability analysis than commercial alternatives. A version match therefore does not automatically prove that vulnerable code is reachable in your application. Treat a finding as a triage item: identify the component and fixed version, determine whether the vulnerable path is used, and assign an owner for the patch or documented exception.
A sensible CI pattern
- Run the dependency scan on pull requests so new vulnerable versions are visible before merge.
- Scan the built image after the image is assembled, because the final layers may differ from the source dependency graph.
- Scan IaC from the same commit that will be deployed.
- Set a policy for which severities block a merge and which create a tracked task for later remediation.
- Keep the scanner’s vulnerability data current and record the scanner version with the build result.
Grype and Syft: the SBOM-first alternative
Grype is a fast vulnerability scanner for container images and filesystems. It pairs naturally with Syft, which generates an SBOM, allowing the inventory and the vulnerability-matching step to remain distinct. OWASP’s source-analysis catalog lists Grype as open source for Linux, macOS, and Windows.
Choose this pair when
- Your build already produces SBOMs as a release artifact.
- You need a small command-line tool that is easy to script.
- You scan container images or unpacked filesystems more often than IaC templates.
- You want to retain an inventory that can be rescanned as vulnerability data changes.
How the workflow differs from a one-command scanner
- Generate an SBOM for the image or filesystem with Syft.
- Store that SBOM alongside the build or release metadata.
- Run Grype against the image, filesystem, or SBOM.
- Send the resulting findings to the same review process used for other security checks.
- If continuous monitoring becomes important, feed CycloneDX SBOMs into Dependency-Track.
The advantage is traceability: you can preserve exactly what components were present in a released artifact. The trade-off is an extra pipeline step and a narrower documented scope than Trivy’s combined dependency, image, and IaC coverage.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →OSV-Scanner: lockfile and ecosystem-native matching
OSV-Scanner is Google’s scanner backed by the OSV.dev database. It scans lockfiles, SBOMs, and container images. OWASP also describes guided remediation and call analysis for some ecosystems, which can help a team move from “a package is affected” toward “here is the upgrade or usage context to investigate.”
Choose OSV-Scanner when
- Lockfiles are the authoritative record of your dependency versions.
- You want vulnerability matching tied closely to the package ecosystem’s data.
- You need the same scanner to inspect an SBOM and a container image.
- Guided remediation or call analysis is valuable for the ecosystems your project uses.
Do not assume call analysis applies uniformly across languages. Check the current support for each ecosystem and treat the result as triage assistance, not a guarantee that an application is safe.
OWASP Dependency-Check: the focused Java/JVM choice
OWASP describes Dependency-Check as a long-established CVE scanner across many languages and says it is easy to add to Maven, Gradle, or CI pipelines. Its strongest fit is a Java or JVM-heavy organization that wants dependency checks close to the build.
Use it for build-time dependency control
- Add the Dependency-Check integration to the Maven or Gradle build used by the project.
- Run it in pull-request or CI jobs so dependency changes are evaluated before release.
- Review each CVE finding against the resolved dependency version and the available fixed version.
- Document accepted risks and false positives rather than silently suppressing them.
- Add a separate image scanner if the application is shipped in containers, and add a DAST tool if it is exposed as a web application.
Dependency-Check is intentionally a focused component scanner. Selecting it does not provide container, IaC, or dynamic web testing by itself.
OWASP ZAP: the web-application complement
A dependency report cannot observe how a running application handles requests. ZAP fills that gap with automated scanning and tools for expert manual web-application penetration testing.
Where ZAP fits
- Deploy the application to a disposable test or staging environment.
- Give the scanner an authenticated context when important routes require login.
- Run automated checks against the deployed build.
- Use the manual-testing features to investigate workflows automation cannot understand.
- Keep SCA and image scans in the same release pipeline; ZAP is complementary, not a replacement.
Dynamic testing can produce findings that depend on test data, authentication, route coverage, and application state. A clean run means the tested surface produced no reported issue under those conditions, not that untested routes are secure.
Dependency-Track and DefectDojo: when CI reports are no longer enough
Dependency-Track for continuous component monitoring
Dependency-Track is appropriate when a team needs to know what is deployed, which component versions are affected by a newly disclosed vulnerability, and whether a VEX decision has already been made. It accepts CycloneDX SBOMs and continuously monitors sources including NVD, GitHub Advisories, and OSV.
Adopt it after you have a reliable SBOM-producing step. Without current SBOMs, a central dashboard becomes an incomplete inventory. Define ownership for each application or component, establish how often SBOMs are uploaded, and require a decision for findings that are fixed, mitigated, not affected, or accepted.
DefectDojo for a mixed scanner estate
DefectDojo is useful when the same organization runs dependency, container, IaC, and DAST tools and needs one place to aggregate, deduplicate, and manage their findings. It supports more than 100 scanner formats according to OWASP’s description.
Aggregation reduces duplicate tickets, but it does not make an inaccurate source finding accurate. Keep the original scanner, version, evidence, and affected asset attached to each imported result so an engineer can reproduce the issue.
Recommended stacks by team situation
| Team situation | Starting stack | Why |
|---|---|---|
| One repository, containers, and IaC | Trivy in CI | One broad CLI covers the main artifact types with low setup overhead. |
| SBOM is a release requirement | Syft plus Grype | Syft creates the inventory and Grype performs fast matching against it. |
| Java or JVM is the dominant build | OWASP Dependency-Check, plus Trivy for images and IaC | Dependency-Check fits Maven and Gradle while Trivy covers delivery artifacts outside the build graph. |
| Public or internal web application | Trivy or Dependency-Check for components, plus ZAP for DAST | The component scanner and the running-application scanner inspect different evidence. |
| Several scanners and many teams | Existing scanners plus DefectDojo | Central aggregation and deduplication create one findings workflow. |
| Need ongoing SBOM exposure monitoring | SBOM generator plus Dependency-Track | Persistent monitoring and VEX decisions extend beyond a one-time CI result. |
How to introduce scanning without overwhelming a small team
1. Inventory what you actually ship
List repositories, lockfiles, container images, IaC directories, and deployed web applications. A team cannot choose a useful scanner until it knows which artifacts exist. Start with the artifact that creates the highest operational risk and the least implementation friction.
2. Establish a baseline
Run the selected scanner on the current default branch and classify findings by component, fixed version, severity, reachability evidence, and owner. Do not block every existing issue immediately; that can make developers ignore the pipeline. Create a dated baseline and block newly introduced policy violations first.
3. Define a remediation policy
- Specify which severities require action and by when.
- Require a fixed-version upgrade where one exists and is compatible with the application.
- Record why a finding is not affected, unreachable, mitigated, or accepted.
- Assign ownership to a team, not an anonymous queue.
- Recheck exceptions when the component, application, or vulnerability data changes.
4. Add artifact-specific checks
Use Trivy for a broad first pass, then add ZAP for a running web application, Dependency-Check for a JVM-centered build, or Grype and Syft when SBOM handling is the priority. Avoid installing every scanner at once; each additional tool creates another data source, update process, and class of findings to triage.
5. Decide when to centralize
Stay with CI reports while one or two teams can review them reliably. Add Dependency-Track when you need a continuously updated component inventory and VEX decisions. Add DefectDojo when multiple scanner formats create duplicate findings or separate queues that no one can reconcile.
False positives, reachability, and remediation: the decisions scanners cannot make for you
OWASP advises choosing dependency tools that use several reliable input sources and can flag false positives. A scanner identifies a potentially vulnerable component; it does not automatically change the fixed version in your codebase or prove that the vulnerable function is reachable.
Review a finding in this order
- Confirm the affected package name and exact resolved version.
- Identify whether the component is direct, transitive, present only in a build stage, or included in the shipped artifact.
- Check the vulnerability’s affected-version range and available fix.
- Assess reachability and runtime exposure using the application’s dependency graph and configuration.
- Choose an upgrade, removal, mitigation, compensating control, or documented acceptance.
- Re-run the scan and close the finding only when the resulting evidence supports closure.
Tools with guided remediation or call analysis can reduce investigation time, but they do not remove the need for an owner who understands the application.
Common mistakes and how to correct them
“One scanner covers security.”
Correction: Map each scanner to its input. Dependencies, images, IaC, source code, secrets, and running applications are different evidence sets.
Scanning only the source repository
Correction: Scan the final container image and the IaC that will be deployed. Build steps can add packages that are not obvious from the application repository.
Blocking every legacy finding on day one
Correction: Baseline existing findings, block newly introduced policy violations, and work through the backlog with named owners.
Treating a severity label as a verdict
Correction: Check affected versions, reachability, exposure, and available fixes. Severity helps prioritize; it does not determine exploitability in your specific deployment.
Running a DAST scan without representative authentication
Correction: Provide a safe test environment and the access context needed to exercise protected routes. Record which areas were actually tested.
Installing a dashboard before producing reliable SBOMs
Correction: Make SBOM generation and upload repeatable first. Dependency-Track can only monitor the component inventory it receives.
Assuming a scanner’s current behavior never changes
Correction: Pin or record tool versions, refresh vulnerability data, and review release notes because supported ecosystems, databases, and CI integrations change.
A decision checklist
- Need one broad CLI? Start with Trivy.
- Need fast container or filesystem scanning around an SBOM? Use Grype with Syft.
- Need OSV-backed lockfile and SBOM checks? Use OSV-Scanner.
- Is the build primarily Maven, Gradle, or another JVM workflow? Use OWASP Dependency-Check, then add artifact-specific scanners.
- Need to test a running web application? Add OWASP ZAP.
- Need continuous SBOM and VEX monitoring? Use Dependency-Track.
- Need one workflow for findings from many scanners? Use DefectDojo as the aggregation layer.
The most defensible small-team architecture is incremental: begin with the scanner that matches your dominant artifact, add the missing layer when your delivery process demands it, and centralize only when the number of findings or teams makes separate CI reports unmanageable.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
