Trivy

Open-source scanner for vulnerabilities, misconfigurations and secrets in containers, code and clouds.

Open sourceCode security and static analysis tools

Updated Nov 4, 2026 · AppBreakup editorial · Linux, macOS, Windows

Visit Trivy See 5 alternatives

Is Trivy free?

Yes, free and open source

License:: Apache-2.0

Checked on Trivy's site Nov 4, 2026

Switch from Trivy to

All 5

SonarQube
Starting price: $34/month (Team plan, up to 100k LOC)
Snyk
Starting price: $25 a month, billed monthly (Team)
Semgrep
Starting price: $30 per contributor/month (Teams)

Verified facts: 3 of 3
Alternatives ranked: 5
Approved reviews: 0
Visits sent from here: 0

About Trivy

Trivy is a command-line security scanner maintained by Aqua Security. Point it at a container image, a filesystem, a Git repository, a Kubernetes cluster or infrastructure-as-code files and it reports known vulnerabilities in OS packages and language dependencies, risky configuration, exposed secrets and licence issues. It can also generate a software bill of materials (SBOM) in standard formats. Because it is a single binary with no server to run, it is a common pick for CI pipelines, where a build can fail when a scan finds high-severity issues. Trivy is free and open source under the Apache 2.0 licence; Aqua sells a commercial cloud security platform built around similar scanning for teams that want dashboards, policy management and runtime protection. It runs on Linux and macOS, with Windows builds also published, and integrates with GitHub Actions, GitLab CI and many other tools. Compared with developer security platforms like Snyk, it has no hosted dashboard or fix pull requests out of the box, but it covers a wide range of targets at no cost.

Best for: DevOps and platform teams wanting a free, all-in-one scanner for images, IaC and Kubernetes in CI.

What works

Scans images, repos, filesystems, Kubernetes and IaC with one binary
Free and Apache-2.0 licensed with an active project
Generates SBOMs as well as vulnerability reports
Easy to drop into CI pipelines

Why people leave

No hosted dashboard or team reporting without Aqua's paid platform
Does not open automatic fix pull requests like some SaaS tools
Command-line only, so less friendly for non-engineers

Trivy vs SonarQube, Snyk and Semgrep

From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.

Attribute	Trivy	SonarQube	Snyk	Semgrep
Pricing	Open source	Free plan + paid	Free plan + paid	Free plan + paid
Verified price	—	$34/month (Team plan, up to 100k LOC)	$25 a month, billed monthly (Team)	$30 per contributor/month (Teams)
Free plan	Free app	Private projects up to 50k LOC	Yes, $0 a month	Yes, up to 10 contributors
Open source	Yes	Yes	No	Yes
Self-hostable	No	Yes	No	No
Platforms	Linux, macOS, Windows	Web, Self-hosted	Web, Windows, macOS, Linux	Web, Windows, macOS, Linux

Top Trivy alternatives

See all 5

1
SonarQube
Adds code quality and static analysis with a self-hosted dashboard teams can share.
74.4
2
Snyk
Hosted platform with dependency and container scanning, a dashboard and automatic fix pull requests.
68.8
3
Semgrep
Better for finding bugs in your own code with custom rules, plus supply-chain scanning.
64.8
4
Mend.io
Commercial software composition analysis with licence policies and remediation for larger teams.
61.8
5
Checkmarx
Enterprise application security suite covering SAST, SCA and container scanning in one place.
57.5

Why people left Trivy

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from Trivy, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of Trivy

Your rating of Trivy

Name

Never shown publicly. A work email helps us verify you.

Title

Your review

What did you use it for, and what was good or bad? At least 40 characters.

Did you switch from another app?

Why did you leave it?

How can we verify you use it? (optional)

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

I received money, credit or a gift for writing this review. (Incentivized reviews are shown but don't count toward rankings.)

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

Trivy: common questions

What is Trivy?

Trivy: Open-source scanner for vulnerabilities, misconfigurations and secrets in containers, code and clouds. Best for devOps and platform teams wanting a free, all-in-one scanner for images, IaC and Kubernetes in CI. Available for Linux, macOS and Windows.

Is Trivy free?

Yes. Trivy is free, open-source software.

Is Trivy open source?

Yes. The source code is on GitHub at aquasecurity/trivy.

What platforms does Trivy run on?

Trivy is available for Linux, macOS and Windows.

What are the best alternatives to Trivy?

The highest-ranked Trivy alternatives right now are SonarQube, Snyk and Semgrep. See the full ranked list for pricing, platforms and verified facts.

Trivy vs SonarQube: what's the difference?

Trivy is free and open source; SonarQube is free with paid plans. Only Trivy runs on Linux, macOS and Windows. Only SonarQube runs on Web.

See all 5 Trivy alternatives

Trivy facts

3 of 3 verified

License: Apache-2.0; Checked Nov 4, 2026github.com(opens source in a new tab); “License: Apache-2.0 (Apache License 2.0).”
Scan targets: Containers, Kubernetes, code repos, clouds; Checked Nov 4, 2026github.com(opens source in a new tab); “Description: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more.”
SBOM generation: Yes; Checked Nov 4, 2026github.com(opens source in a new tab); “Description: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more.”