Alternatives to Trivy
Scan software and infrastructure for known security issues. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Trivy
Scan software and infrastructure for known security issues.
Replacements
Listings that take over the same core job as Trivy.
Grype
Find known vulnerabilities in container images and filesystems.
Grype finds known vulnerabilities in container images and filesystems and can scan SBOMs, but it does not cover the configuration checks that Trivy includes.
OSV-Scanner
Check project dependencies against the OSV vulnerability database.
OSV-Scanner checks project dependencies against the OSV vulnerability database across many ecosystems, focusing on dependency files rather than container images or configuration.
Dependency-Check
OWASP scanner that finds known vulnerabilities in a project's dependencies.
Dependency-Check is an OWASP scanner that matches dependencies to CVEs via CPE, plugs into Maven, Gradle and Jenkins, and needs an NVD API key and download.
Kubescape
Assess Kubernetes configuration and runtime security.
Kubescape narrows the focus to Kubernetes configuration and runtime security, with runtime features requiring installation and permissions inside the cluster.
Also worth comparing
These listings name Trivy as their own alternative, so the relationship runs both ways.
Checkov
Scan infrastructure code for configuration problems.
Trivy combines configuration checks with container and filesystem vulnerability scanning, so one tool covers more than infrastructure code, under the same Apache-2.0 license.
Clair
A self-hosted service that statically analyses container images for known vulnerabilities.
Trivy scans containers, filesystems and configuration for known issues from the command line across platforms, simpler to run than Clair's indexer and matcher service.
kube-bench
Check Kubernetes settings against CIS benchmark tests.
Trivy scans containers, filesystems and configuration for issues, covering more than Kubernetes CIS benchmark checks.
KubeLinter
Review Kubernetes manifests for common configuration problems.
Trivy adds container and filesystem vulnerability scanning alongside configuration checks, so one tool covers images as well as Kubernetes definitions.
Syft
Generate software bills of materials from images and files.
Trivy scans containers, filesystems and configuration for known security issues, so it goes further than inventory, while remaining Apache-2.0 licensed and cross-platform.
Vuls
Assess known vulnerabilities on Linux and FreeBSD systems.
Trivy scans filesystems, containers and configuration for known issues from the command line on Windows, macOS and Linux, rather than assessing remote hosts.
Similar software
Related functionality, not a direct replacement.
Dependency-Track
Track component risk using software bills of materials.
Semgrep
Find code patterns and potential problems with static analysis.
Harbor
A self-hosted container registry with vulnerability scanning, image signing and role-based access control.
