Comparison

Semgrep vs Trivy

No clear leader: Semgrep (64.7) and Trivy (60.8) are within the 5-point margin; treat as a tie. The attribute-by-attribute breakdown below, with a source and date on every value, is the honest way to compare them.

Semgrep full profile →Trivy full profile →

Machine formatsJSON Markdown GraphQLor send Accept: application/json

Semgrep65

Trivy61

Attribute comparison across 2 tools
Attribute	Semgrep	Trivy
Vioscale score	65 / 100high · 76%	61 / 100low · 42%
Pricing
Free tierpricing.free_tier	✓	✓
Modelpricing.model	freemium	open_source
Price levelpricing.price_level	mid	free
Starting pricepricing.starting_price	$15	-
Transparentpricing.transparent	✓	✓
Integrations
Countintegrations.count	20	7
Security
Disclosure policysecurity.disclosure_policy	✓	-
Gdprsecurity.gdpr	✓	-
Scorecardsecurity.scorecard	-	6.4
Soc2security.soc2	✓	-
Vulnerabilitiessecurity.vulnerabilities	Count: 0 · Source: https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=pypi&package_name=semgrep&per_page=100 · Last 12m: 0	Count: 5 · Source: https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Faquasecurity%2Ftrivy&per_page=100 · Last 12m: 4 · Max severity: CRITICAL
Reliability
Status pagereliability.status_page	✓	-
Adoption
Dependent reposadoption.dependent_repos	375	134
Github starsadoption.github_stars	16,407	37,628
Package downloads weeklyadoption.package_downloads_weekly	6,990,780	-
Activity
Commits last 30dactivity.commits_last_30d	42	43
Release
Cadence daysrelease.cadence_days	7	5
Historyrelease.history	20 items	20 items
License
Spdxlicense.spdx	LGPL-2.1	Apache-2.0
Language
Primarylanguage.primary	OCaml	Go
Market
Availabilitymarket.availability	Available worldwide · Popular in US · HQ US	Available worldwide

Score

Vioscale score

Semgrep65 / 100high · 76%

Trivy61 / 100low · 42%

Pricing

Free tier

Semgrep✓

Trivy✓

Model

Semgrepfreemium

Trivyopen_source

Price level

Semgrepmid

Trivyfree

Starting price

Semgrep$15

Trivy–

Transparent

Semgrep✓

Trivy✓

Integrations

Count

Semgrep20

Trivy7

Security

Disclosure policy

Semgrep✓

Trivy–

Gdpr

Semgrep✓

Trivy–

Scorecard

Semgrep–

Trivy6.4

Soc2

Semgrep✓

Trivy–

Vulnerabilities

SemgrepCount: 0 · Source: https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=pypi&package_name=semgrep&per_page=100 · Last 12m: 0

TrivyCount: 5 · Source: https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Faquasecurity%2Ftrivy&per_page=100 · Last 12m: 4 · Max severity: CRITICAL

Reliability

Status page

Semgrep✓

Trivy–

Adoption

Dependent repos

Semgrep375

Trivy134

Github stars

Semgrep16,407

Trivy37,628

Package downloads weekly

Semgrep6,990,780

Trivy–

Activity

Commits last 30d

Semgrep42

Trivy43

Release

Cadence days

Semgrep7

Trivy5

History

Semgrep20 items

Trivy20 items

License

Spdx

SemgrepLGPL-2.1

TrivyApache-2.0

Language

Primary

SemgrepOCaml

TrivyGo

Market

Availability

SemgrepAvailable worldwide · Popular in US · HQ US

TrivyAvailable worldwide

Capabilities

Feature-by-feature on the axes that matter for devsecops tools. “-” means undocumented, not absent.

Capability comparison for DevSecOps Tools
Capability	Semgrep	Trivy
Scan types
SAST (static analysis)	✓	✓
DAST (dynamic analysis)	✗	-
SCA / dependency scanning	✓	✓
Secret scanning	✓	✓
Container / image scanning	✗	✓
IaC misconfiguration scanning	✓	✓
Governance
OSS licence compliance	✓	✓
SBOM generation (SPDX/CycloneDX)	✓	-
Remediation
Automated fix / upgrade PRs	✓	-
Prioritisation
Reachability / exploitability prioritisation	✓	-
Deployment
Hosting	Cloud + self-hosted	Self-hosted only
Integration
First-class CI / pipeline integration	✓	✓
In-editor / IDE scanning	✓	-
Licensing
OSS engine available	✓	✓

Scan types

SAST (static analysis)

Semgrep✓

Trivy✓

DAST (dynamic analysis)

Semgrep✗

Trivy-

SCA / dependency scanning

Semgrep✓

Trivy✓

Secret scanning

Semgrep✓

Trivy✓

Container / image scanning

Semgrep✗

Trivy✓

IaC misconfiguration scanning

Semgrep✓

Trivy✓

Governance

OSS licence compliance

Semgrep✓

Trivy✓

SBOM generation (SPDX/CycloneDX)

Semgrep✓

Trivy-

Remediation

Automated fix / upgrade PRs

Semgrep✓

Trivy-

Prioritisation

Reachability / exploitability prioritisation

Semgrep✓

Trivy-

Deployment

Hosting

SemgrepCloud + self-hosted

TrivySelf-hosted only

Integration

First-class CI / pipeline integration

Semgrep✓

Trivy✓

In-editor / IDE scanning

Semgrep✓

Trivy-

Licensing

OSS engine available

Semgrep✓

Trivy✓

What each one is

The product in its own terms, so the numbers below have context.

Semgrep

A SaaS application security platform combining static code analysis, software composition analysis, and secrets detection in one tool. Uses AI to reduce false positives and prioritize exploitable vulnerabilities discovered during development.

Independently observed

Trivy

A free, open-source tool that scans code repositories, container images, binary artifacts, and Kubernetes clusters to identify vulnerabilities, misconfigurations, secrets, and license compliance issues. Designed for cloud-native environments and integrates into CI/CD pipelines.

Independently observed

Pricing

List pricing as published by each vendor, with the date we read it. Always verify at the source before you buy.

Semgrep

from $15/contributor/moSubscriptionFree tier

Free tier available. Teams start at $30/contributor/mo. Enterprise custom pricing with volume discounts.

Free EditionFree
- Cross-file analysis with Pro rules
- AI-powered detection, triage, and remediation
- Code scanning
- Supply Chain scanning
- 60 AI credits
- +2 more
Teams$30/contributor/mo (Code or Supply Chain) or $15/contributor/mo (Secrets)
- One-click CI/CD deploy using Semgrep infrastructure
- Single sign-on (SSO)
- Award-winning support
- Pro Engine with 35+ supported languages
- Cross-function Taint Analysis
- +14 more
EnterpriseContact sales
- Everything in Teams, plus:
- Support for on-prem source code management
- Support for custom CI/CD integrations
- Optional deployment in dedicated infrastructure
- Unlimited repositories and contributors
- +6 more

as of 2026-08-24verify ↗

Trivy

Open sourceFree tier

as of 2026-08-14verify ↗

Platform & deployment

Where each product runs and how it can be hosted. A dash means undocumented, not unsupported.

Platform and deployment support comparison
Supports	Semgrep	Trivy
WebPlatforms	✓	✗
CLIPlatforms	✓	✓
Cloud / SaaSDeployment	✓	✗
Self-hostedDeployment	✓	✓
On-premiseDeployment	✓	✗
HybridDeployment	✓	✗

Platforms

Web

Semgrep✓

Trivy✗

CLI

Semgrep✓

Trivy✓

Deployment

Cloud / SaaS

Semgrep✓

Trivy✗

Self-hosted

Semgrep✓

Trivy✓

On-premise

Semgrep✓

Trivy✗

Hybrid

Semgrep✓

Trivy✗

Integrations

What each product connects to. Counts come from the vendor's own integration directory where one exists.

In common (2)

GitHub
GitLab

Semgrep

28 total - 26 not shared

Bitbucket
Jenkins
CircleCI
Azure
Buildkite
HackerOne
Slack
Email
Webhooks
VS Code
IntelliJ
Jira
Wiz
Palo Alto Networks Cortex
REST API
Cursor
Replit
Codacy
OpenID Connect
SAML
GitHub OAuth
GitLab OAuth
Azure AD
Azure DevOps
+2 more

Independently observed

Trivy

7 total - 5 not shared

Docker
Azure Container Registry
Kubernetes
Harbor
CloudNativePG

Independently observed

Comparison generated from independently-sourced facts. Every value links to its source and retrieval date. See the method.