Compare / Trivy and Grype

Trivy vs Grype vs Stackurity: scanners and the inventory above them

Trivy and Grype scan an image, a directory or an SBOM each time you run them. Stackurity keeps an inventory of what you run, re-checks it every hour, and can take in their SBOMs.

In short. Trivy and Grype are free, open-source command-line scanners. You point them at an image, a directory or an SBOM and they report the vulnerabilities in it, which makes them a natural fit for CI. Trivy also finds misconfigurations, secrets and licences; Grype focuses on vulnerabilities and ranks them with a risk score that combines severity with EPSS and the CISA KEV catalogue.

Stackurity is not another scanner of that kind, and not a drop-in replacement for either. It is the layer above them: a live inventory of servers, deployed applications, repositories, images, Kubernetes and AWS, re-checked every hour, with end-of-life dates, P1 to P4 priorities and fixes tracked until a fresh report confirms them. It can import the SBOMs that Trivy and Syft produce.

What each one is

Trivy

Trivy is a security scanner from Aqua Security. It has targets (container images, filesystems, remote Git repositories, virtual machine images and Kubernetes) and scanners (vulnerabilities, misconfigurations, secrets, licences and SBOMs)^[1]. It runs as a CLI, in CI through a GitHub Action, in Kubernetes through an operator and in VS Code through a plugin^[1]. Aqua sells a commercial platform built on top of it^[1]^[5].

Grype

Grype is a vulnerability scanner for container images, filesystems and SBOMs, sponsored by Anchore^[7]. It pairs with Syft, Anchore’s SBOM generator: Syft lists the packages, and Grype can scan that list^[7]^[11]. Grype shows EPSS scores, marks known exploited vulnerabilities, sorts results by a risk score, and supports OpenVEX^[7]^[8].

Stackurity

Stackurity is open-source vulnerability and end-of-life management. It keeps one live inventory of the software on your servers, deployed applications, repositories, container images, Kubernetes and AWS managed services. It matches that inventory against new advisories and the CISA KEV catalogue every hour and against end-of-life dates every day, and gives each team a short list of upgrades, most urgent first. After a fix it checks again and records whether the issue is really gone.

Grype vs Trivy vs Stackurity, side by side

Scroll the table sideways to see every column.

	Trivy	Grype	Stackurity
What it is	Open-source security scanner, run from the command line; an Aqua Security open-source project^[1]^[5]	Open-source vulnerability scanner, run from the command line; sponsored by Anchore^[7]	Open-source server with a dashboard, API and agents that keeps an inventory up to date over time
Inventory sources	Container images, filesystems, remote Git repositories, virtual machine images and Kubernetes^[1]; a host’s root filesystem^[4]; SBOMs^[3]	Container images (Docker, OCI and Singularity), filesystems and SBOMs^[7]	A read-only agent on Linux servers, repositories and CI scans, container images, Kubernetes workloads, AWS managed services, and CycloneDX or SPDX SBOMs
What it finds	Known vulnerabilities, infrastructure-as-code misconfigurations, secrets and software licences; also lists packages as an SBOM^[1]	Known vulnerabilities^[7]	Known vulnerabilities and end of life
Ecosystems	A long list of Linux distributions, including Alpine, Wolfi, Red Hat Enterprise Linux, CentOS, AlmaLinux, Rocky Linux, Oracle Linux, Azure Linux, Amazon Linux, SUSE, Debian and Ubuntu^[2]; languages including C/C++, Dart, .NET, Elixir, Go, Java, Node.js, PHP, Python, Ruby, Rust, Swift and Julia^[13]	Major OS package ecosystems, including Alpine, Debian, Ubuntu, RHEL, Oracle Linux and Amazon Linux; language packages including Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust^[7]	Packages assessed on Debian, Ubuntu, Alpine, Rocky Linux, AlmaLinux, RHEL, SUSE Linux Enterprise, openSUSE Leap, Oracle Linux and Amazon Linux 2023 and 2. npm, Composer, PyPI, Go, RubyGems, NuGet and Dart; Maven, Gradle, Cargo, Hex and Swift through stack packs (C/C++ and CocoaPods are inventoried only)
End-of-life tracking	Warns when an operating system version is no longer supported by its distribution, because detection may be insufficient; listed as end of life awareness for distributions such as Debian^[14]^[15]	Warns when packages come from an end-of-life distribution, because its vulnerability data may be incomplete^[9]	End-of-life dates for operating systems, runtimes, Kubernetes and AWS managed services, checked daily
CISA KEV and exploitation priority	Trivy’s open-source edition triages by severity, according to Aqua’s comparison with its commercial product^[5]	Shows EPSS scores and marks entries in the CISA KEV catalogue; sorts results by a risk score by default^[8]	CISA KEV checked hourly; each finding gets a priority from P1 to P4 from exploitation, exposure and environment, with one sentence on why
Fix tracking and verification	Ignore specific vulnerabilities by ID or property; tracking across scans is listed as part of Aqua’s commercial product^[5]	Filter by fix state, for example only issues with a fix, and apply VEX documents^[10]	One card per upgrade; Check again asks the agent for a fresh report and records passed, partly fixed or still open; issues that come back are flagged
CI gate	Can fail the build on any finding^[5]	`--fail-on` returns a non-zero exit code at or above a severity^[10]	`stackurity scan --fail-on`, by severity, priority or CISA KEV
SBOM	Generates CycloneDX and SPDX, and scans SBOMs as input^[3]	Scans SBOMs, for example from Syft; writes JSON, table, CycloneDX, SARIF and template output^[7]^[10]	Imports CycloneDX or SPDX JSON; exports any asset as CycloneDX 1.6; scans images with the bundled Syft
Deployment	A single binary, container image or Homebrew package^[1]; guides for GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines and other CI systems^[16]; an optional client/server mode^[12]; a Kubernetes operator^[1]	A single binary, also through Homebrew, Docker and other installers^[7]	A server you run with Docker Compose or a Helm chart, or Stackurity Cloud
Licence	Apache-2.0^[1]	Apache-2.0^[7]	Apache-2.0 core; some team and automation features are paid
Pricing	Free. Aqua Security sells a commercial platform that builds on Trivy^[1]	Free. Anchore offers commercial support^[7]	Community: free forever, self-hosted. Stackurity Cloud: 14-day free trial, then from $10 a month
AI assistant (MCP)	An MCP server plugin (`trivy plugin install mcp`), MIT-licensed, for VS Code, Cursor, JetBrains IDEs and Claude Desktop^[6]	Anchore published a separate MCP server for Grype, grype-mcp; its GitHub repository is now archived^[17]	Built-in MCP server with OAuth sign-in, for Claude, ChatGPT, Cursor, VS Code and other MCP clients

Trivy and Grype details checked on 29 Oct 2026; the numbers in brackets link to the sources. Stackurity details: compatibility, editions, AI assistants and pricing.

Grype vs Trivy for CI and image scanning

Both are Apache-2.0, both scan images, filesystems and SBOMs, and both work well as a CI step. The differences are in scope and in how they rank results:

Scope. Trivy is a general security scanner: besides vulnerabilities it checks infrastructure as code, secrets and licences, and it scans Kubernetes clusters and virtual machine images^[1]. Grype does one job, vulnerabilities^[7].
Ranking. Grype shows EPSS scores, marks CISA KEV entries and sorts by a combined risk score by default^[8]. Aqua’s comparison describes Trivy’s open-source edition as triaging by severity, with exploitability-based prioritisation in its commercial product^[5].
End-of-life distributions. Both warn when an operating system release is end of life, because its vulnerability data may be incomplete^[9]^[14]^[15]. Neither tracks end-of-life dates for runtimes or services in the docs we checked.
SBOMs. Trivy generates CycloneDX and SPDX itself^[3]. Grype relies on Syft for that, and Syft also writes CycloneDX and SPDX^[11].

Where Trivy and Grype are stronger

CI image scanning without a server. A single binary scans an image in the pipeline and fails the build^[5]^[10]. Stackurity has a CI gate too, but it reports to a Stackurity server.
More distributions. Trivy lists distributions such as Wolfi, Chainguard, Azure Linux and CentOS^[2]. Stackurity assesses Oracle Linux 7 to 10 from Oracle's own advisories, and inventories CentOS and Fedora but does not assess their packages.
Wider checks (Trivy). Misconfigurations, secrets and licences in the same tool^[1].
Risk scoring with EPSS (Grype). EPSS percentiles alongside KEV, sorted by risk^[8]. Stackurity also uses EPSS: a CVE scored at 10% or more raises its priority, alongside KEV, exposure and environment. An advisory covering several CVEs counts the one with the highest EPSS.
Nothing to host. They are free command-line tools with no server to run.

Where Stackurity is stronger

What is running, continuously. A read-only agent reports what is installed on each server, including runtimes installed by hand and the libraries deployed applications load, and every asset is re-checked as new advisories arrive, without re-running a scan.
End of life for the whole stack. Operating systems, runtimes, Kubernetes versions and AWS managed services such as RDS, Lambda and EKS.
One list for many teams. Projects, roles, alerts to Slack, Microsoft Teams, email, webhooks or Jira, one-way PagerDuty alerts and ServiceNow incident records, assignment, snoozing and ignoring with expiry and approval.
Fixes that are proven. Each upgrade is one card; Check again records whether the fix landed, and audit reports count only real fixes.

Which should you choose?

Choose Trivy if

you want one free scanner in CI for images, infrastructure as code, secrets and licences;
you need distributions such as Wolfi, Chainguard or Azure Linux.

Choose Grype if

you want a focused vulnerability scanner that ranks results with EPSS, KEV and a risk score;
you already generate SBOMs with Syft.

Choose Stackurity if

you need to know what is running on servers and in deployed applications, not just what was in an image at build time;
you want end-of-life tracking, exploitation-first priorities and fixes tracked across teams;
you want the results of every scan in one place, over time, with history and alerts.

Using them together

Keep Trivy or Grype as the gate in your pipeline, and send the SBOM to Stackurity so the image stays in the inventory after it ships. Trivy writes CycloneDX^[3], and Stackurity imports CycloneDX or SPDX JSON:

trivy image --format cyclonedx --output shop.cdx.json ghcr.io/acme/shop:1.4
stackurity sbom import shop.cdx.json --asset-name shop

With Syft, syft <image> -o cyclonedx-json=./shop.cdx.json does the same^[11]. Stackurity then matches the components itself, adds end-of-life and CISA KEV priorities, and re-checks them as new advisories arrive. It can also scan images directly from a registry with its bundled Syft; see Installing.

Questions

Grype vs Trivy: which should I use?

Use Trivy if you want one scanner for vulnerabilities, misconfigurations, secrets and licences across images, filesystems, repositories and Kubernetes. Use Grype if you want a focused vulnerability scanner that ranks results with EPSS, CISA KEV and a risk score, especially alongside Syft. Both are free under Apache-2.0.

Is Stackurity a replacement for Trivy or Grype?

Not a drop-in one. Trivy and Grype are command-line scanners that report on the target you point them at when you run them; Stackurity is a server that keeps a live inventory of servers, applications, repositories, images, Kubernetes and AWS, and tracks priorities and fixes over time. It has its own CI gate and image scanning, so some teams use it alone, but many keep a scanner in CI.

Can Stackurity import Trivy or Syft output?

Yes, as SBOMs. Stackurity imports CycloneDX or SPDX JSON, which Trivy and Syft can both write. It then matches the components against its own vulnerability, CISA KEV and end-of-life data.

Do Trivy and Grype track end of life?

Both warn when a scanned image or filesystem runs an operating system release that its distribution no longer supports, since vulnerability data for it may be incomplete. Neither tracks end-of-life dates for runtimes, Kubernetes or managed services in the docs we checked. Stackurity tracks end-of-life dates for operating systems, runtimes, Kubernetes and AWS managed services.

Do Trivy and Grype use the CISA KEV catalogue?

Grype marks vulnerabilities in the CISA KEV catalogue and treats them as the highest threat in its risk score. Aqua’s comparison describes Trivy’s open-source edition as triaging by severity. Stackurity checks CISA KEV hourly and FIRST EPSS daily and uses them with exposure and environment to set a P1 to P4 priority.

Does Stackurity use Trivy or Grype internally?

Its container image scanning uses Syft, Anchore’s SBOM generator, bundled with the server. Matching against advisories, CISA KEV and end-of-life data is done by Stackurity itself.

Try Stackurity on what you run

Start a 14-day free trial of Stackurity Cloud, no card needed, or download the free Community edition and run it on your own server.

Start free trial Download

Sources

Details of other products were checked on 29 Oct 2026 against their own documentation, websites, pricing pages and GitHub READMEs, listed below. Products change; follow the links for the current details. Details of Stackurity come from its documentation and pricing. Product names are trademarks of their owners and are used here only to refer to their products.