# Trivy vs Veracode

**Leader by vioscaleAI score:** Veracode

| Attribute | Trivy | Veracode |
|---|---|---|
| **vioscaleAI score** | 58.5 (41% (low)) | 73 (52% (medium)) |
| activity.commits_last_30d | 61 | - |
| adoption.dependent_repos | 134 | - |
| adoption.github_stars | 38,396 | - |
| content.faq | `[{"answer":"A free, open-source tool that scans code repositories, container images, binary artifacts, and Kubernetes clusters to identify vulnerabilities, misconfigurations, secrets, and license compliance issues. Designed for cloud-native environments and integrates into CI/CD pipelines. It is indexed under DevSecOps Tools.","source":"https://trivy.dev","question":"What is Trivy?","confidence":0.6},{"answer":"Trivy is open source, so it can be self-hosted and used at no licence cost. It is released under the Apache-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://trivy.dev","question":"Is Trivy free to use?","confidence":0.6},{"answer":"Trivy supports a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://trivy.dev","question":"What platforms does Trivy support?","confidence":0.6},{"answer":"Yes. Trivy can be deployed self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://trivy.dev","question":"Can Trivy be self-hosted?","confidence":0.6},{"answer":"We have confirmed 7 integrations for Trivy, including Docker, GitHub, GitLab, Azure Container Registry, Kubernetes, Harbor and CloudNativePG. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://trivy.dev","question":"What does Trivy integrate with?","confidence":0.6},{"answer":"Yes. Trivy is published under the Apache-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/aquasecurity/trivy","question":"Is Trivy open source?","confidence":0.95}]` | - |
| deployment.options | `{"self_hosted":true}` | `{"cloud":true}` |
| description.long | Trivy is a comprehensive security scanner that detects vulnerabilities, configuration problems, sensitive data, and license compliance issues in container images, virtual machine images, and source code repositories. It supports multiple programming languages, operating systems, and platforms with integration into popular development and deployment tools. | A comprehensive platform for identifying, prioritizing, and fixing application security vulnerabilities across code, dependencies, containers, and infrastructure. It combines static and dynamic testing with AI-driven remediation to reduce security risk while maintaining developer velocity. |
| features.capabilities | `{"sca":true,"sast":true,"sbom":true,"hosting":"self","ci_native":true,"ide_plugin":true,"open_source":true,"iac_scanning":true,"secret_scanning":true,"container_scanning":true,"license_compliance":true}` | `{"sca":true,"dast":true,"sast":true,"hosting":"cloud","ci_native":true,"ide_plugin":true,"auto_fix_pr":true,"iac_scanning":true,"reachability":true,"container_scanning":true,"license_compliance":true}` |
| integrations.count | 7 | 25 |
| integrations.list | `[{"name":"Docker"},{"name":"GitHub"},{"name":"GitLab"},{"name":"Azure Container Registry"},{"name":"Kubernetes"},{"name":"Harbor"},{"name":"CloudNativePG"},{"name":"VS Code"},{"name":"Docker Hub"}]` | `[{"name":"GitHub","native":true,"category":"repository","direction":"inbound"},{"name":"GitLab","native":true,"category":"repository","direction":"inbound"},{"name":"AWS","native":true,"category":"cloud","direction":"inbound"},{"name":"Google Cloud","native":true,"category":"cloud","direction":"inbound"},{"name":"Microsoft Defender for Cloud","native":true,"category":"security","direction":"inbound"},{"name":"Snyk","native":true,"category":"security","direction":"inbound"},{"name":"Checkmarx","native":true,"category":"security","direction":"inbound"},{"name":"Contrast Security","native":true,"category":"security","direction":"inbound"},{"name":"Fortify OnDemand","native":true,"category":"security","direction":"inbound"},{"name":"Rapid7 InsightAppSec","native":true,"category":"security","direction":"inbound"},{"name":"Qualys","native":true,"category":"vulnerability","direction":"inbound"},{"name":"JFrog Xray","native":true,"category":"security","direction":"inbound"},{"name":"AWS Config","native":true,"category":"compliance","direction":"inbound"},{"name":"AWS Inspector","native":true,"category":"security","direction":"inbound"},{"name":"Prisma Cloud","native":true,"category":"security","direction":"inbound"},{"name":"Wiz","native":true,"category":"security","direction":"inbound"},{"name":"CrowdStrike","native":true,"category":"security","direction":"inbound"},{"name":"Orca","native":true,"category":"security","direction":"inbound"},{"name":"SecurityScorecard","native":true,"category":"security","direction":"inbound"},{"name":"Terraform Cloud","native":true,"category":"iac","direction":"inbound"}]` |
| language.primary | Go | - |
| license.spdx | Apache-2.0 | - |
| market.availability | `{"primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | - |
| platform.support | `{"cli":true}` | `{"cli":true,"web":true}` |
| pricing | `{"type":"open_source","sourceUrl":"https://trivy.dev","retrievedAt":"2026-10-13T22:31:00.968Z"}` | - |
| pricing.free_tier | yes | - |
| pricing.model | open_source | commercial |
| pricing.price_level | free | - |
| pricing.transparent | yes | - |
| release.cadence_days | 10 | - |
| release.history | `[{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.75.0","date":"2026-10-01T13:34:13Z","type":"stable","version":"v0.75.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.74.0","date":"2026-08-14T11:29:11Z","type":"stable","version":"v0.74.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.73.0","date":"2026-08-03T10:47:14Z","type":"stable","version":"v0.73.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.72.0","date":"2026-06-30T09:34:06Z","type":"stable","version":"v0.72.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.2","date":"2026-06-19T10:37:28Z","type":"stable","version":"v0.71.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.1","date":"2026-06-15T09:12:47Z","type":"stable","version":"v0.71.1"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.0","date":"2026-06-01T13:49:26Z","type":"stable","version":"v0.71.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.70.0","date":"2026-04-17T06:50:02Z","type":"stable","version":"v0.70.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.69.3","date":"2026-03-03T13:14:48Z","type":"stable","version":"v0.69.3"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.69.2","date":"2026-03-01T19:14:14Z","type":"stable","version":"v0.69.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.26.0","date":"2022-04-15T21:41:49Z","type":"stable","version":"v0.26.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.4","date":"2022-04-11T16:29:57Z","type":"stable","version":"v0.25.4"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.3","date":"2022-04-06T07:16:49Z","type":"stable","version":"v0.25.3"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.2","date":"2022-04-05T10:27:43Z","type":"stable","version":"v0.25.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.1","date":"2022-04-04T21:55:13Z","type":"stable","version":"v0.25.1"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.0","date":"2022-03-31T11:39:16Z","type":"stable","version":"v0.25.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.4","date":"2022-03-17T19:49:15Z","type":"stable","version":"v0.24.4"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.3","date":"2022-03-16T13:29:58Z","type":"stable","version":"v0.24.3"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.2","date":"2022-03-03T10:52:56Z","type":"stable","version":"v0.24.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.1","date":"2022-02-27T16:04:56Z","type":"stable","version":"v0.24.1"}]` | - |
| reliability.status_page | - | yes |
| security.fedramp | - | yes |
| security.gdpr | - | yes |
| security.hipaa | - | yes |
| security.iso27001 | - | yes |
| security.pci | - | yes |
| security.scorecard | 6.4 | - |
| security.soc2 | - | yes |
| security.trust_center | - | https://www.veracode.com/security/ |
| security.vulnerabilities | `{"count":5,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Faquasecurity%2Ftrivy&per_page=100","last_12m":4,"max_severity":"CRITICAL"}` | - |

## Capabilities (DevSecOps Tools)

| Capability | Trivy | Veracode |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | ✓ | ✓ |
| DAST (dynamic analysis) | - | ✓ |
| SCA / dependency scanning | ✓ | ✓ |
| Secret scanning | ✓ | - |
| Container / image scanning | ✓ | ✓ |
| IaC misconfiguration scanning | ✓ | ✓ |
| **Governance** |  |  |
| OSS licence compliance | ✓ | ✓ |
| SBOM generation (SPDX/CycloneDX) | ✓ | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | - | ✓ |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | - | ✓ |
| **Deployment** |  |  |
| Hosting | Self-hosted only | Cloud only |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | ✓ | ✓ |
| **Licensing** |  |  |
| OSS engine available | ✓ | - |

*Source: vioscaleAI. Generated 2026-10-16T20:08:28.546Z. "-" = undocumented, not absent.*