Trivy is a free, open-source scanner for container, code, and cloud vulnerabilities, misconfigurations, and secrets. See features, pricing, and comparisons.
Trivy is a free, open-source security scanner maintained by Aqua Security that unifies vulnerability detection, infrastructure-as-code misconfiguration scanning, secret detection, and software license scanning into a single command-line tool. It was originally created by developer Teppei Fukuda as a personal project and was brought under the Aqua Security open-source umbrella in 2019, after which Fukuda joined the company to continue leading its development.
The tool is designed to scan across the full software supply chain: container images, application filesystems, git repositories, virtual machine images, and live Kubernetes clusters. This breadth means teams can use one tool, rather than stitching together separate scanners for containers, code, and cloud configuration, to get consistent security findings across their stack.
Trivy is distributed under the Apache 2.0 license and ships as a dependency-free, single static binary, which has helped it become one of the most widely adopted open-source scanners in the cloud-native ecosystem, with tens of thousands of GitHub stars and hundreds of contributors.
Trivy's core strength is breadth combined with simplicity: it detects vulnerabilities in both operating system packages (Alpine, Debian, RHEL, and others) and language-specific dependencies (npm, pip, Go modules, and more), pulling data from the Aqua Vulnerability Database and other public advisories, and it is noted for maintaining low false-positive rates even on notoriously noisy distributions.
Beyond vulnerabilities, Trivy scans Infrastructure-as-Code files for misconfigurations, scans source code and file systems for hardcoded secrets, checks open-source license compliance, and can generate a Software Bill of Materials (SBOM) for any scanned target. It also supports Kubernetes-native scanning, including generating a Kubernetes Bill of Materials (KBOM) that inventories cluster components and their vulnerabilities.
Because it requires no database setup or external middleware, Trivy integrates cleanly into CI/CD pipelines, pre-commit hooks, IDE extensions like the VS Code integration, and container registries, giving teams a fast feedback loop that fits naturally into existing DevSecOps workflows.
The core Trivy scanner is entirely free and open source under the Apache 2.0 license, with no feature limitations, usage caps, or paywalls between the community and any commercial tier; every scanning capability described above is available at no cost.
Aqua Security monetizes separately through the Aqua Platform, a commercial cloud-native application protection platform (CNAPP) built on top of Trivy's scanning engine that adds centralized dashboards, runtime protection, policy enforcement, and enterprise support. Aqua Platform pricing is custom and requires contacting Aqua Security's sales team; it is a distinct commercial product rather than a paid tier of Trivy itself.
Trivy is used to scan containers, code repositories, filesystems, and Kubernetes clusters for vulnerabilities, misconfigurations, exposed secrets, and license issues.
Yes, Trivy is completely free and open source under the Apache 2.0 license with no feature restrictions.
Trivy is maintained by Aqua Security, after being created by developer Teppei Fukuda and brought into Aqua's open-source portfolio in 2019.
Trivy is the free open-source scanning engine, while the Aqua Platform is a separate paid commercial product built on top of Trivy that adds dashboards, runtime protection, and enterprise support.
Yes, Trivy includes a secret-scanning engine that detects hardcoded credentials and exposed secrets in code and images.
Yes, Trivy supports scanning live Kubernetes clusters and can generate a Kubernetes Bill of Materials (KBOM).
Trivy is released under the Apache 2.0 open-source license.
Trivy offers broader multi-target scanning (containers, IaC, secrets, licenses) in one free tool, whereas Grype focuses mainly on vulnerabilities and Snyk's core scanning is commercial with a limited free tier.