Trivy

Factual Product Summary

Trivy is an open-source security scanner for developers and security engineers checking container images, code repositories, filesystem content and supported infrastructure targets. It helps surface known vulnerabilities and other security findings before artifacts move further through a delivery process. Capabilities - Vulnerability scanning: checks supported operating-system packages and application dependencies against security data. Results depend on the target, package metadata and available vulnerability records. - Repository scanning: accepts local or remote repositories. Vulnerability and secret scanning are enabled by default for repository targets; additional scanners can be selected explicitly. - Misconfiguration scanning: checks supported infrastructure definitions, including Terraform HCL, JSON and supported plan representations. This gives teams a way to review configuration risks alongside code changes. - Secret scanning: looks for supported patterns of exposed credentials in scanned content. Findings require review before deciding whether a credential needs revocation or rotation. - License scanning: provides license findings for supported components when the relevant scanner is enabled. Legal interpretation and policy decisions remain with the organization. - SBOM scanning: accepts supported CycloneDX and SPDX representations, including SPDX JSON, so a software inventory can become an input to vulnerability or license checks. Operating workflow Choose a scan target and scanner set, run the check locally or in a build pipeline, then route findings to the team responsible for the affected package or configuration. Establish filtering and exception rules deliberately so accepted risks do not hide new problems. Trivy downloads and maintains security databases; database access and update behavior matter when operating in restricted environments. Buyer and implementation questions - How is it deployed? Trivy can run as a command-line scanner locally or in CI workflows. Check the installation and database configuration for the intended environment. - What should a pilot test? Use representative images and repositories, confirm dependency coverage and output handling, and measure scan time and the triage effort created by findings. - Is it a substitute for runtime protection? Its role in this entry is scanning supported artifacts and configurations. Design runtime monitoring and incident response separately. - What should be configured before broader adoption? Decide which scanners run for each target, how findings affect build decisions, how exceptions are approved and how security data stays current.