# Burp Suite vs Trivy

**Leader by Vioscale score:** Trivy

| Attribute | Burp Suite | Trivy |
|---|---|---|
| **Vioscale score** | 37.6 (41% (low)) | 60.8 (42% (low)) |
| activity.commits_last_30d | - | 43 |
| adoption.dependent_repos | - | 134 |
| adoption.github_stars | - | 37,628 |
| deployment.options | - | `{"self_hosted":true}` |
| description.long | A security testing tool for web applications and APIs that combines manual and automated vulnerability scanning. Includes CI pipeline integration and is used by security professionals, AppSec teams, and development organizations. | A free, open-source tool that scans code repositories, container images, binary artifacts, and Kubernetes clusters to identify vulnerabilities, misconfigurations, secrets, and license compliance issues. Designed for cloud-native environments and integrates into CI/CD pipelines. |
| features.capabilities | `{"dast":true,"ci_native":true}` | `{"sca":true,"sast":true,"hosting":"self","ci_native":true,"open_source":true,"iac_scanning":true,"secret_scanning":true,"container_scanning":true,"license_compliance":true}` |
| integrations.count | - | 7 |
| integrations.list | - | `[{"name":"Docker"},{"name":"GitHub"},{"name":"GitLab"},{"name":"Azure Container Registry"},{"name":"Kubernetes"},{"name":"Harbor"},{"name":"CloudNativePG"}]` |
| language.primary | - | Go |
| license.spdx | - | Apache-2.0 |
| market.availability | - | `{"primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | - | `{"cli":true}` |
| pricing | - | `{"type":"open_source","freeTier":true,"sourceUrl":"https://trivy.dev","retrievedAt":"2026-08-14T15:30:47.970Z"}` |
| pricing.free_tier | - | yes |
| pricing.model | commercial | open_source |
| pricing.price_level | - | free |
| pricing.transparent | - | yes |
| release.cadence_days | - | 5 |
| release.history | - | `[{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.74.0","date":"2026-08-14T11:29:11Z","type":"stable","version":"v0.74.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.73.0","date":"2026-08-03T10:47:14Z","type":"stable","version":"v0.73.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.72.0","date":"2026-06-30T09:34:06Z","type":"stable","version":"v0.72.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.2","date":"2026-06-19T10:37:28Z","type":"stable","version":"v0.71.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.1","date":"2026-06-15T09:12:47Z","type":"stable","version":"v0.71.1"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.0","date":"2026-06-01T13:49:26Z","type":"stable","version":"v0.71.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.70.0","date":"2026-04-17T06:50:02Z","type":"stable","version":"v0.70.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.69.3","date":"2026-03-03T13:14:48Z","type":"stable","version":"v0.69.3"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.69.2","date":"2026-03-01T19:14:14Z","type":"stable","version":"v0.69.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.26.0","date":"2022-04-15T21:41:49Z","type":"stable","version":"v0.26.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.4","date":"2022-04-11T16:29:57Z","type":"stable","version":"v0.25.4"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.3","date":"2022-04-06T07:16:49Z","type":"stable","version":"v0.25.3"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.2","date":"2022-04-05T10:27:43Z","type":"stable","version":"v0.25.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.1","date":"2022-04-04T21:55:13Z","type":"stable","version":"v0.25.1"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.25.0","date":"2022-03-31T11:39:16Z","type":"stable","version":"v0.25.0"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.4","date":"2022-03-17T19:49:15Z","type":"stable","version":"v0.24.4"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.3","date":"2022-03-16T13:29:58Z","type":"stable","version":"v0.24.3"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.2","date":"2022-03-03T10:52:56Z","type":"stable","version":"v0.24.2"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.1","date":"2022-02-27T16:04:56Z","type":"stable","version":"v0.24.1"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.24.0","date":"2022-02-23T12:43:55Z","type":"stable","version":"v0.24.0"}]` |
| reliability.status_page | yes | - |
| security.fedramp | yes | - |
| security.gdpr | yes | - |
| security.hipaa | yes | - |
| security.pci | yes | - |
| security.scorecard | - | 6.4 |
| security.vulnerabilities | - | `{"count":5,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Faquasecurity%2Ftrivy&per_page=100","last_12m":4,"max_severity":"CRITICAL"}` |

## Capabilities (DevSecOps Tools)

| Capability | Burp Suite | Trivy |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | - | ✓ |
| DAST (dynamic analysis) | ✓ | - |
| SCA / dependency scanning | - | ✓ |
| Secret scanning | - | ✓ |
| Container / image scanning | - | ✓ |
| IaC misconfiguration scanning | - | ✓ |
| **Governance** |  |  |
| OSS licence compliance | - | ✓ |
| SBOM generation (SPDX/CycloneDX) | - | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | - | - |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | - | - |
| **Deployment** |  |  |
| Hosting | - | Self-hosted only |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | - | - |
| **Licensing** |  |  |
| OSS engine available | - | ✓ |

*Source: Vioscale. Generated 2026-09-01T17:07:19.043Z. "-" = undocumented, not absent.*