Aqua Security
Aqua Security offers a portfolio covering assessing cloud exposure or protecting running workloads. The entries in this catalog include Aqua Platform and Trivy. Aqua Platform focuses on cloud-native workload security and runtime protection. Trivy focuses on container vulnerability and configuration scanning. When reviewing Aqua Security, compare the named products individually: a platform family, a specific module and a managed service can have different scopes and purchasing requirements. Selection should account for cloud permissions required for onboarding, the assets assessed, runtime coverage and how findings reach remediation owners. Portfolio detail - Aqua Platform: the catalog lists Cloud security posture management, Cloud workload protection, Container security. - Trivy: the catalog lists Container image scanning, Kubernetes security. For procurement, map each required capability to a named offering and confirm the edition, dependencies and delivery responsibility with the vendor. Product-level entries below provide the operational context and evaluation questions for that comparison.
Documented Software Products (2)
Aqua Platform
Aqua Platform from Aqua Security focuses on cloud-native workload security and runtime protection. It is cloud security technology used for assessing cloud exposure or protecting running workloads. Capabilities - Cloud security posture management: Finds cloud configuration risks so teams can prioritize corrections across connected environments. - Cloud workload protection: Focuses on protecting workloads running in the cloud rather than only inspecting account configuration. - Container security: Addresses security issues in container images or running containerized applications within the documented scope. - Kubernetes security: Brings Kubernetes assets or configuration into the cloud security assessment workflow. - Runtime threat detection: Uses activity from running workloads to identify or respond to active threats. Use and operational context Aqua Platform is relevant to cloud and security teams working across accounts and workloads when the requirement centers on assessing cloud exposure or protecting running workloads. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review cloud permissions required for onboarding, the assets assessed, runtime coverage and how findings reach remediation owners. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Aqua Platform focuses on assessing cloud exposure or protecting running workloads. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Trivy
Trivy is an open-source security scanner for developers and security engineers checking container images, code repositories, filesystem content and supported infrastructure targets. It helps surface known vulnerabilities and other security findings before artifacts move further through a delivery process. Capabilities - Vulnerability scanning: checks supported operating-system packages and application dependencies against security data. Results depend on the target, package metadata and available vulnerability records. - Repository scanning: accepts local or remote repositories. Vulnerability and secret scanning are enabled by default for repository targets; additional scanners can be selected explicitly. - Misconfiguration scanning: checks supported infrastructure definitions, including Terraform HCL, JSON and supported plan representations. This gives teams a way to review configuration risks alongside code changes. - Secret scanning: looks for supported patterns of exposed credentials in scanned content. Findings require review before deciding whether a credential needs revocation or rotation. - License scanning: provides license findings for supported components when the relevant scanner is enabled. Legal interpretation and policy decisions remain with the organization. - SBOM scanning: accepts supported CycloneDX and SPDX representations, including SPDX JSON, so a software inventory can become an input to vulnerability or license checks. Operating workflow Choose a scan target and scanner set, run the check locally or in a build pipeline, then route findings to the team responsible for the affected package or configuration. Establish filtering and exception rules deliberately so accepted risks do not hide new problems. Trivy downloads and maintains security databases; database access and update behavior matter when operating in restricted environments. Buyer and implementation questions - How is it deployed? Trivy can run as a command-line scanner locally or in CI workflows. Check the installation and database configuration for the intended environment. - What should a pilot test? Use representative images and repositories, confirm dependency coverage and output handling, and measure scan time and the triage effort created by findings. - Is it a substitute for runtime protection? Its role in this entry is scanning supported artifacts and configurations. Design runtime monitoring and incident response separately. - What should be configured before broader adoption? Decide which scanners run for each target, how findings affect build decisions, how exceptions are approved and how security data stays current.