Trivy

What it is

Trivy is an open source, all-in-one security scanner from Aqua Security. It started as a container image vulnerability scanner and has since expanded to cover filesystem and git repository scanning, Kubernetes cluster scanning, infrastructure-as-code misconfiguration checks for tools like Terraform and Kubernetes manifests, exposed secrets, and software bill of materials (SBOM) generation, all from a single binary.

What it finds

Running Trivy against a container image checks installed OS packages and language-specific dependencies against known vulnerability databases and flags anything with a published CVE, along with its severity. Its misconfiguration checks catch common infrastructure-as-code mistakes, such as an overly permissive security group or a container running as root, before they reach production. Its secrets scanner catches credentials accidentally baked into an image or repository.

How to use it

The simplest starting point is scanning a single container image with one command to see its known vulnerabilities and their severities. From there, most teams add Trivy to CI so every image build is scanned before it is pushed to a registry, and often add a Kubernetes-native deployment so it continuously scans workloads already running in a cluster.

Free versus paid

Trivy itself is entirely free and open source with no paid tier gating its features. Aqua Security also sells a commercial platform, but Trivy the scanner is not limited or crippled to push people toward it.

Prerequisites

Basic familiarity with containers and, for the Kubernetes and infrastructure-as-code checks, some exposure to those tools helps interpret results. No security background is required to run a first scan and read its output.

Limitations

Vulnerability data is only as current as Trivy's databases, which it downloads and caches; scanning offline without refreshing that cache will miss newly disclosed issues. Like any scanner, it will also flag vulnerabilities in dependencies that are present but never actually reachable in your code, so findings still need triage rather than blind trust.

Common questions

Does Trivy replace a web application scanner like ZAP or Burp? No, it covers a different layer, supply chain and infrastructure, rather than testing a running web application's behaviour.

Can it fail a CI build automatically? Yes, its exit code and severity thresholds are designed to be wired into a pipeline gate.

Does it need network access to run? It needs network access to update its vulnerability database, though a cached or air-gapped database mode exists for restricted environments.