Try our new research platform with insights from 80,000+ expert users

JFrog Xray vs Trivy comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

SentinelOne Singularity Clo...
Sponsored
Ranking in Container Security
3rd
Average Rating
8.6
Reviews Sentiment
7.8
Number of Reviews
104
Ranking in other categories
Vulnerability Management (6th), Cloud and Data Center Security (5th), Cloud Workload Protection Platforms (CWPP) (4th), Cloud Security Posture Management (CSPM) (4th), Cloud-Native Application Protection Platforms (CNAPP) (3rd), Compliance Management (3rd)
JFrog Xray
Ranking in Container Security
20th
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
8
Ranking in other categories
Vulnerability Management (24th), Software Composition Analysis (SCA) (6th), Software Supply Chain Security (3rd)
Trivy
Ranking in Container Security
25th
Average Rating
8.4
Reviews Sentiment
7.5
Number of Reviews
5
Ranking in other categories
No ranking in other categories
 

Featured Reviews

Andrew W - PeerSpot reviewer
Tells us about vulnerabilities as well as their impact and helps to focus on real issues
Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.
Mokshi Pandita - PeerSpot reviewer
An intelligent solution that prioritizes which vulnerability to target first in your project
We could create any number of repositories, but we can create only thirty projects with JFrog Xray. If I want things to work, it has to be one project and multiple repositories that belong to different real projects. So I have a limitation of thirty projects, despite being a premium customer. JFrog Xray does not have a dashboard. Although I am able to generate reports, there is no proper dashboard where I can see the total number of vulnerabilities, the total number of license issues, and how many vulnerabilities are fixed. Second, I found the shift left approach missing with JFrog Xray. JFrog Xray has integration with IDEs, but it does not tell you about the vulnerabilities until the artifact is created. However, Snyk could directly integrate with your repository and would not allow you to build unless you fix the problem.
Faizan Anwar - PeerSpot reviewer
Open source solution simplifies vulnerability scanning and suggests automation improvements
In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis. It would be beneficial to have an automated report mechanism for outputs in formats like Excel or CSV. Additionally, recommendations based on scanning reports, especially as the world is moving towards AI, would be helpful. Including YAML configuration scanning, in addition to Terraform, would enhance its utility.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"PingSafe stands out for its user-friendly interface and intuitive software, making it easy to navigate and use."
"The cloud misconfiguration is the most valuable feature."
"The most valuable aspects of PingSafe are its alerting system and the remediation guidance it provides."
"The UI is very good."
"For Singularity, the task capability is easy to use and it has a very intuitive dashboard, which streamlines the processes."
"Cloud Native Security's evidence-based reporting allows us to prioritize issues by understanding their impact, helping us resolve the most important problems first."
"It gives me the information I need."
"PingSafe released a new security graph tool that helps us identify the root issue. Other tools give you a pass/fail type of profile on all misconfigurations, and those will run into the thousands. PingSafe's graphing algorithm connects various components together and tries to identify what is severe and what is not. It can correlate various vulnerabilities and datasets to test them on the back end to pinpoint the real issue."
"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."
"JFrog Xray shows us a list of vulnerabilities that can impact our code."
"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."
"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."
"The solution is stable and reliable."
"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."
"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."
"JFrog Xray's reporting feature has a lot of options in it, including scanning."
"I can see vulnerabilities in the images of any applications deployed in the Kubernetes environment or as container applications."
"The most valuable feature of Trivy is its easy integration with the CI/CD pipeline."
"It's customizable, allowing me to add any rules and format HTML templates as I wish."
"One of the great features of Trivy is that it helps me scan items such as AWS credentials and GCP service accounts."
"I definitely recommend Trivy."
"Trivy's open source nature and wide functionality are incredibly valuable."
"It is open-source."
"Trivy's open source nature and wide functionality are incredibly valuable."
 

Cons

"They can work on policies based on different compliance standards."
"I would like PingSafe's detections to be openly available online instead of only accessible through their portal. Other tools have detections that are openly available without going through the tool."
"Customized queries should be made easier to improve PingSafe."
"While SentinelOne Singularity Cloud Security offers robust protection, its cost could be a barrier for some users."
"When you find a vulnerability and resolve it, the same issue will not occur again. I want PingSafe to block the same vulnerability from appearing again. I want something like a playbook where the steps that we take to resolve an issue are repeated when that issue happens again."
"If something happens in our infrastructure, the alert appears on the dashboard, but I have to log in to the dashboard and refresh it. I would prefer it to provide better alerting and notifications so that I can resolve issues on priority."
"Crafting customized policies can be tricky."
"They need more experienced support personnel."
"JFrog Xray does not have a dashboard."
"JFrog Xray's documentation and error logging could be improved."
"X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL."
"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."
"Since we have been using the solution via APIs, there are some limitations in the APIs."
"Lacks deeper reporting, the ability to compare things."
"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."
"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."
"The reporting could be a little better. When integrating Trivy with CI, the interpretation of the reports could be improved."
"Currently, the container image scanning is static. A dynamic scanning capability during runtime would be a significant advantage."
"Trivy can improve by providing an output in PDF format."
"For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools. That would be my suggestion."
"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."
"Trivy can improve by providing an output in PDF format. Additionally, it takes longer to scan container images built with many layers."
"For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools."
"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."
 

Pricing and Cost Advice

"PingSafe is less expensive than other options."
"PingSafe's primary advantage is its ability to consolidate multiple tools into a single user interface, but, beyond this convenience, it may not offer significant additional benefits to justify its price."
"We have an enterprise license. It is affordable. I'm not sure, but I think we pay 150,000 rupees per month."
"I am not involved in the pricing, but it is cost-effective."
"SentinelOne offers excellent pricing and licensing options."
"The licensing is easy to understand and implement, with some flexibility to accommodate dynamic environments."
"I would rate the cost a seven out of ten with ten being the most costly."
"The pricing for PingSafe in India was more reasonable than other competitors."
Information not available
Information not available
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
831,997 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
18%
Financial Services Firm
15%
Manufacturing Company
9%
Government
5%
Financial Services Firm
25%
Manufacturing Company
13%
Computer Software Company
13%
Healthcare Company
5%
Computer Software Company
17%
Financial Services Firm
14%
Manufacturing Company
12%
Government
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about PingSafe?
The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...
What is your experience regarding pricing and costs for PingSafe?
SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven.
What needs improvement with PingSafe?
The areas with room for improvement include the cost, which is higher compared to other security platforms. The dashb...
What do you like most about JFrog Xray?
JFrog Xray shows us a list of vulnerabilities that can impact our code.
What needs improvement with JFrog Xray?
X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL. More support ...
What is your primary use case for JFrog Xray?
Our primary use case for X-ray includes multiple activities such as security and vulnerability scanning. We already u...
What needs improvement with Trivy?
The reporting could be a little better. When integrating Trivy with CI, the interpretation of the reports could be im...
What is your primary use case for Trivy?
We are using Trivy for status analysis tests of our code bases, primarily for security and malware testing.
What advice do you have for others considering Trivy?
I would recommend starting to use Trivy and explore the documentation, as it is quite comprehensive. Understanding th...
 

Also Known As

PingSafe
JFrog Security Essentials
No data available
 

Overview

 

Sample Customers

Information Not Available
google, amazon, cisco, netflix, oracle, vmware, facebook
Information Not Available
Find out what your peers are saying about JFrog Xray vs. Trivy and other solutions. Updated: January 2025.
831,997 professionals have used our research since 2012.