Trivy Reviews

Name: Trivy
Brand: Aqua Security
Rating: 4.3 (6 reviews)

4.3 out of 5

6 reviews
100% willing to recommend

What is Trivy?

Trivy is a versatile tool for scanning container images and identifying vulnerabilities, favored for its integration with CI/CD pipelines and ease of use. It supports scanning both operating system packages and application dependencies.

Get the Container Security Buyer's Guide and find out what your peers are saying about Trivy, Wiz, Prisma Cloud by Palo Alto Networks and more!

Trivy is the #19 ranked solution in Container Security Solutions. PeerSpot users give Trivy an average rating of 8.6 out of 10. Trivy is most commonly compared to Wiz: Trivy vs Wiz. Trivy is popular among the large enterprise segment, accounting for 65% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 17% of all views.

Buyer's Guide

Container Security

February 2025

Get the category report

Helped 832,138 peers since 2012

Featured reviews

Faizan Anwar

Cloud DevOps Lead at Venturenox

In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis. It would be beneficial to have an automated report mechanism for outputs in formats like Excel or CSV. Additionally, recommendations based on scanning reports, especially as the world is moving towards AI, would be helpful. Including YAML configuration scanning, in addition to Terraform, would enhance its utility.

Read full review

Jyothikumar C

Senior Engineering Manager at Ninjacart

For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools. That would be my suggestion.

Read full review

Goutham Kumar

Principal DevSecOPs at a computer software company with 10,001+ employees

Trivy's open source nature and wide functionality are incredibly valuable. It can scan Kubernetes files, detect Dockerfile issues, and even scan Terraform code. The ease of use and ability to integrate into CI/CD pipelines in a straightforward manner make it a beneficial tool. Additionally, it supports all operating systems and maintains an up-to-date security vulnerability CVE list. Another major advantage is its ability to find secrets and sensitive information in code.

Read full review

Trivy mindshare

As of February 2025, the mindshare of Trivy in the Container Security category stands at 4.8%, up from 0.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Container Security

Key learnings from peers

Last updated Feb 1, 2025

Valuable Features

Trivy's most valuable features include easy CI/CD pipeline integration, scanning of AWS and GCP credentials, customizable rules, open-source accessibility, and quick setup. Users appreciate its capability to scan Kubernetes, Dockerfile, and Terraform code, detect secrets in code, identify vulnerabilities and expired libraries, and integrate with tools like Grafana. Its ability to support all operating systems and maintain an updated CVE list enhances its reliability and convenience for developers.

"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."
"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."
"I rate Trivy a nine out of ten."

Room for Improvement

Trivy users suggest improvements in reporting, including better integration with CI, PDF outputs, and more export options. The container scan time could be faster. An expanded vulnerability database and a built-in interface for dynamic scanning during runtime are requested. Users desire enhanced malware detection capabilities and additional configuration scanning. Integration with AWS or GCP and support for various output formats would add value. Addressing open issues on GitHub could enhance stability.

"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."
"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."
"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."

Popular Use Cases

Trivy is primarily used for vulnerability scanning in code bases, container applications, and Docker images. It is integrated into pipelines for security and malware testing, aiding in addressing issues with appropriate developers. As part of the DevSecOps process, it is included in CSCD pipelines for continuous scanning. Users have incorporated Trivy into microservices and infrastructure scanning, utilizing it daily in CI/CD environments. Trivy also assists in analyzing open-source vulnerabilities in application code.

Service and Support

Trivy users often rely on comprehensive documentation and community resources for guidance. Many report using GitHub for issue resolution, noting quick attention to queries, although changes may take time to deploy in the stable version. Some rely on internal teams for expertise, minimizing the need for direct customer service contact. Users often prefer community support due to Trivy's open-source nature, with some opting for enterprise versions for personalized assistance.

Deployment

Trivy's initial setup is consistently reported as easy and quick, requiring no more than a few minutes for deployment. Users find it straightforward, largely due to clear documentation and comprehensive packages like Helm charts. Many attribute the seamless experience to prior familiarity with technologies such as Kubernetes and authorization. Installation in containers for image scanning also highlights the efficient process. Users with various levels of technical background confirm Trivy's accessibility and simplicity in setup.

Scalability

Trivy exhibits strong scalability in CI environments, efficiently scanning extensive codebases and multiple microservices. Challenges appear when handling numerous resources or container images simultaneously. While some organizations experience seamless multi-instance operation, others suggest improvements in report mechanisms. Effective integration into CI/CD pipelines is noted, but users emphasize the importance of scaling associated tools rather than Trivy itself. A learning curve may exist for standalone use, but command-line capabilities enhance versatility.

Stability

Trivy is noted for its stability, with users expressing confidence in its performance. They report no major stability issues or performance problems compared to other tools. It operates effectively within diverse systems and pipeline environments. From the perspective of different users, Trivy remains consistently stable, facilitating reliable operations without disruptions. Users appreciate Trivy's dependable nature and smooth functioning in various use cases. Stability is a key trait highlighted across experiences.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Container Security Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

17%

Financial Services Firm

15%

Manufacturing Company

12%

Government

Comms Service Provider

University

Retailer

Energy/Utilities Company

Healthcare Company

Insurance Company

Hospitality Company

Real Estate/Law Firm

Legal Firm

Construction Company

Consumer Goods Company

Educational Organization

Media Company

Transportation Company

Non Profit

Outsourcing Company

Performing Arts

Aerospace/Defense Firm

Wholesaler/Distributor

Pharma/Biotech Company

Recreational Facilities/Services Company

Marketing Services Firm

Compare Trivy with alternative products

Learn more about Trivy

Trivy is an efficient tool designed to automate security checks and ensure compliance. Its quick setup, detailed analysis capabilities, and support for multiple programming languages and environments make it a reliable choice for users. Trivy provides comprehensive scanning and integration with CI/CD pipelines, resulting in accurate vulnerability detection and a smoother workflow for developers.

What are the most important features?

Efficient vulnerability detection: Quickly identifies vulnerabilities in container images.
Comprehensive scanning: Supports scanning of both OS packages and application dependencies.
CI/CD pipeline integration: Seamlessly integrates with CI/CD tools for automated security checks.
Broad language support: Handles multiple programming languages and environments.
Ease of use: Simple setup and user-friendly interface.

What benefits or ROI should users look for?

Improved security: Regular and thorough vulnerability scanning enhances security posture.
Compliance maintenance: Helps in maintaining compliance with security policies and regulations.
Cost efficiency: Automation reduces the time and cost associated with manual security checks.
Integration flexibility: Efficiently integrates with existing CI/CD pipelines to streamline workflows.
Detailed reporting: Provides comprehensive reports for better decision-making.

Trivy is widely used in industries with a focus on maintaining high security standards such as finance, healthcare, and technology sectors. Its ability to detect vulnerabilities quickly and integrate with CI/CD pipelines makes it an essential tool for ensuring secure and compliant software development practices in these industries. Continuous improvements in speed, documentation, and integration could further enhance its value.