JFrog Xray vs Trivy comparison

JFrog and Aqua Security are both solutions in the Container Security category. JFrog is ranked #19 with an average rating of 8.0, while Aqua Security is ranked #13 with an average rating of 8.6. JFrog holds a 4.8% mindshare in Container Security, compared to Aqua Security’s 6.8% mindshare. Additionally, 100% of JFrog users are willing to recommend the solution, compared to 100% of Aqua Security users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between JFrog Xray and Trivy based on real PeerSpot user reviews.

Find out in this report how the two Container Security solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed JFrog Xray vs. Trivy Report (Updated: January 2025).

Buyer's Guide

JFrog Xray vs. Trivy

January 2025

Download the complete report

Helped 839,319 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of March 2025, in the Container Security category, the mindshare of SentinelOne Singularity Cloud Security is 2.1%, up from 1.1% compared to the previous year. The mindshare of JFrog Xray is 4.8%, up from 2.5% compared to the previous year. The mindshare of Trivy is 6.8%, up from 0.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Container Security

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Mokshi Pandita

DevOps Engineer at Rambøll Danmark A/S

An intelligent solution that prioritizes which vulnerability to target first in your project

We could create any number of repositories, but we can create only thirty projects with JFrog Xray. If I want things to work, it has to be one project and multiple repositories that belong to different real projects. So I have a limitation of thirty projects, despite being a premium customer. JFrog Xray does not have a dashboard. Although I am able to generate reports, there is no proper dashboard where I can see the total number of vulnerabilities, the total number of license issues, and how many vulnerabilities are fixed. Second, I found the shift left approach missing with JFrog Xray. JFrog Xray has integration with IDEs, but it does not tell you about the vulnerabilities until the artifact is created. However, Snyk could directly integrate with your repository and would not allow you to build unless you fix the problem.

Read full review

Utsav Sharma

Senior Security Consultant at Ernst & Young

Maintain operational efficiency by detecting misconfigurations and vulnerabilities

The vulnerability scanning feature is excellent as it supports various container capabilities like Docker and Sharma. It also offers repository scanning in the source code domain, allowing pre-push code scans. The misconfiguration detection works well for CloudFormation, Docker files, and Terraform. Its compliance support, like NIST, ensures that configurations align with standards. Trivy helps me significantly detect misconfigurations missed by the ops engineers or in Terraform by the naked eye. It ensures that my deployments are free of misconfigurations and vulnerabilities.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Cloud Native Security offers a valuable tool called an offensive search engine."

"For Singularity, the task capability is easy to use and it has a very intuitive dashboard, which streamlines the processes."

"PingSafe offers comprehensive security posture management."

"PingSafe offers an intuitive user interface that lets us navigate quickly and easily."

"We like PingSafe's vulnerability assessment and management features, and its vulnerability databases."

"Support has been very helpful and provides regular feedback and help whenever needed. They've been very useful."

"Our organization is growing steadily, so our infrastructure is expanding, and we're managing more technical resources. Singularity Cloud Security helps us track our resources so that we don't get lost in the overwhelming volume of things and ensures we follow best practices. The solution gives us better visibility into our resources and enables faster resolution."

"PingSafe released a new security graph tool that helps us identify the root issue. Other tools give you a pass/fail type of profile on all misconfigurations, and those will run into the thousands. PingSafe's graphing algorithm connects various components together and tries to identify what is severe and what is not. It can correlate various vulnerabilities and datasets to test them on the back end to pinpoint the real issue."

More SentinelOne Singularity Cloud Security pros

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"JFrog Xray shows us a list of vulnerabilities that can impact our code."

"The solution is stable and reliable."

"Good reporting functionalities."

"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."

"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."

"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."

More JFrog Xray pros

"I appreciate Trivy for being open-source and not requiring any payment."

"The most valuable feature of Trivy is its easy integration with the CI/CD pipeline."

"I can see vulnerabilities in the images of any applications deployed in the Kubernetes environment or as container applications."

"Trivy is particularly useful for checking if Docker images have critical vulnerabilities before they reach production."

"I rate Trivy a nine out of ten."

"One of the great features of Trivy is that it helps me scan items such as AWS credentials and GCP service accounts."

"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."

"It's customizable, allowing me to add any rules and format HTML templates as I wish."

More Trivy pros

Cons

"We are getting reports only in a predefined form. I would like to have customized reports so that I can see how many issues are open or closed today or in two weeks."

"There's an array of upcoming versions with numerous features to be incorporated into the roadmap. Customers particularly appreciate the service's emphasis on intensive security, especially the secret scanning aspect. During the proof of concept (POC) phase, the system is required to gather logs from the customer's environment. This process entails obtaining specific permissions, especially in terms of gateway access. While most permissions for POC are manageable, the need for various permissions may need improvement, especially in the context of security."

"The cost has the potential for improvement."

"While the future roadmap presented by SentinelOne appears promising, I hope the envisioned advancements are realistically achievable and that the gap between current offerings and long-term goals is not too significant."

"Scanning capabilities should be added for the dark web."

"When we get a new finding from PingSafe, I wish we could get an alert in the console, so we can work on it before we see it in the report. It would be very useful for the team that is actively working on the PingSafe platform, so we can close the issue the same day before it appears in the daily report."

"The areas with room for improvement include the cost, which is higher compared to other security platforms. The dashboard can also be laggy."

"They can work on policies based on different compliance standards."

More SentinelOne Singularity Cloud Security cons

"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."

"Since we have been using the solution via APIs, there are some limitations in the APIs."

"JFrog Xray's documentation and error logging could be improved."

"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."

"X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL."

"Lacks deeper reporting, the ability to compare things."

"The speed of JFrog Xray should improve. Other solutions have better performance."

"JFrog Xray does not have a dashboard."

More JFrog Xray cons

"For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools."

"Having little experience can hinder the ability to connect it to a user-friendly UI effectively."

"Trivy generates many false positives, flagging non-existent vulnerabilities. Improvements could include better contextual analysis or granular filtering."

"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."

"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."

"Trivy can improve by providing an output in PDF format. Additionally, it takes longer to scan container images built with many layers."

"Currently, the container image scanning is static. A dynamic scanning capability during runtime would be a significant advantage."

"The reporting could be a little better. When integrating Trivy with CI, the interpretation of the reports could be improved."

More Trivy cons

Pricing and Cost Advice

"It is cost-effective compared to other solutions in the market."

"SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven."

"PingSafe is cost-effective for the amount of infrastructure we have. It's reasonable for what they offer compared to our previous solution. It's at least 25 percent to 30 percent less."

"It was reasonable pricing for me."

"PingSafe is priced reasonably for our workload."

"It is cheap."

"I am not involved in the pricing, but it is cost-effective."

"Singularity Cloud Security by SentinelOne is cost-efficient."

More SentinelOne Singularity Cloud Security pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Container Security solutions are best for your needs.

See recommendations

839,319 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

26%

Manufacturing Company

13%

Computer Software Company

12%

Healthcare Company

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven.

See all answers

What needs improvement with PingSafe?

From my personal experience, the alerting system needs to be faster. If something happens in our infrastructure, the ...

See all answers

What do you like most about JFrog Xray?

JFrog Xray shows us a list of vulnerabilities that can impact our code.

See all answers

What needs improvement with JFrog Xray?

X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL. More support ...

See all answers

What is your primary use case for JFrog Xray?

Our primary use case for X-ray includes multiple activities such as security and vulnerability scanning. We already u...

See all answers

What needs improvement with Trivy?

One drawback I have observed with Trivy is the difficulty in building or integrating a UI, particularly for an operat...

See all answers

What is your primary use case for Trivy?

The main use case for Trivy is to scan Docker images or packages for CVEs, specifically for vulnerabilities. I use th...

See all answers

What advice do you have for others considering Trivy?

I rate Trivy an eight out of ten. This rating reflects its open-source nature, comprehensive scanning capabilities, a...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 24% of the time

Cortex Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 21% of the time

AWS GuardDuty vs SentinelOne Singularity Cloud Security

Compared 8% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 6% of the time

More SentinelOne Singularity Cloud Security Competitors

Black Duck vs JFrog Xray

Compared 17% of the time

Veracode vs JFrog Xray

Compared 7% of the time

Cortex Cloud by Palo Alto Networks vs JFrog Xray

Compared 6% of the time

Mend.io vs JFrog Xray

Compared 5% of the time

Snyk vs JFrog Xray

Compared 5% of the time

More JFrog Xray Competitors

Snyk vs Trivy

Compared 21% of the time

Cortex Cloud by Palo Alto Networks vs Trivy

Compared 7% of the time

Wiz vs Trivy

Compared 7% of the time

Kubescape vs Trivy

Compared 7% of the time

SUSE NeuVector vs Trivy

Compared 6% of the time

More Trivy Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

February 2025

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

JFrog Xray

February 2025

Download JFrog Xray product report

Buyer's Guide

Container Security

February 2025

Download Trivy product report

Also Known As

PingSafe

JFrog Security Essentials

No data available

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

SentinelOne

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

If you are a team player and you care and you play to WIN, we have just the job you're looking for.

As we say at JFrog: "Once You Leap Forward You Won't Go Back!"

JFrog

Trivy is a versatile tool for scanning container images and identifying vulnerabilities, favored for its integration with CI/CD pipelines and ease of use. It supports scanning both operating system packages and application dependencies.

Trivy is an efficient tool designed to automate security checks and ensure compliance. Its quick setup, detailed analysis capabilities, and support for multiple programming languages and environments make it a reliable choice for users. Trivy provides comprehensive scanning and integration with CI/CD pipelines, resulting in accurate vulnerability detection and a smoother workflow for developers.

What are the most important features?

Efficient vulnerability detection: Quickly identifies vulnerabilities in container images.
Comprehensive scanning: Supports scanning of both OS packages and application dependencies.
CI/CD pipeline integration: Seamlessly integrates with CI/CD tools for automated security checks.
Broad language support: Handles multiple programming languages and environments.
Ease of use: Simple setup and user-friendly interface.

What benefits or ROI should users look for?

Improved security: Regular and thorough vulnerability scanning enhances security posture.
Compliance maintenance: Helps in maintaining compliance with security policies and regulations.
Cost efficiency: Automation reduces the time and cost associated with manual security checks.
Integration flexibility: Efficiently integrates with existing CI/CD pipelines to streamline workflows.
Detailed reporting: Provides comprehensive reports for better decision-making.

Trivy is widely used in industries with a focus on maintaining high security standards such as finance, healthcare, and technology sectors. Its ability to detect vulnerabilities quickly and integrate with CI/CD pipelines makes it an essential tool for ensuring secure and compliant software development practices in these industries. Continuous improvements in speed, documentation, and integration could further enhance its value.

Aqua Security

Sample Customers

Information Not Available

google, amazon, cisco, netflix, oracle, vmware, facebook

Information Not Available

Buyer's Guide

JFrog Xray vs. Trivy

January 2025

Free Report: JFrog Xray vs. Trivy

Find out what your peers are saying about JFrog Xray vs. Trivy and other solutions. Updated: January 2025.

DOWNLOAD NOW

839,319 professionals have used our research since 2012.

See our JFrog Xray vs. Trivy report.

See our list of best Container Security vendors.

We monitor all Container Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.