Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs Trivy
Trivy
7.0#11 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitWhat both publish
| Fact | Grype | Trivy |
|---|---|---|
| Founded | 2016 | 2015 |
| Headquarters | Santa Barbara, California, United States | Boston, Massachusetts, and Ramat Gan, Israel |
| License | The project is released under the Apache-2.0 License. | The Trivy homepage identifies the project as Go software under the Apache-2.0 License. |
| Output formats | Configuration supports table, template, JSON and CycloneDX vulnerability-report outputs. | Aqua says Trivy can export results in formats including JUnit XML, SARIF, and AWS Security Finding Format (ASFF). |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | Trivy scans code repositories, binary artifacts, container images, and Kubernetes clusters for vulnerabilities and misconfigurations. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
Trivy plans
- TrivyFree
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick Trivy if…
Trivy suits developers and security teams scanning code, containers, or Kubernetes environments for vulnerabilities and misconfigurations. It also fits teams that need SBOM generation or CI/CD integration.