Open-Source Security Tools
Trivy: The All-in-One Vulnerability Scanner for Images and Code
Trivy is Aquasecurity's open-source scanner that checks almost everything in a modern stack: container images and filesystems, IaC templates, git repos, Kubernetes manifests, secrets, and license compliance, with CVE data updated continuously. Its power in practice is being the scanner a CI pipeline can actually gate on, with exit codes that fail builds.
Key points
- The surface is deliberately wide: OS package CVEs and application dependencies (npm, pip, Go modules, Java JARs), IaC misconfigurations (Dockerfile/Terraform/K8s), embedded secrets (API keys, private keys), and license compliance; one tool collapses four scan categories into one CLI invocation.
- CI gating is the operational payoff: --exit-code 1 --severity CRITICAL,HIGH turns scanning into a build gate; ignoring filtered CVEs via .trivyignore with expiry comments sets the 90-day review habit that keeps the gate honest rather than permanently bypassed.
- Scanning modes cover the estate: image scan (registry or local daemon), filesystem scan on source trees, repo scan on git history, Kubernetes cluster scan (via k8s subcommand), and SBOM generation (CycloneDX/SPDX) for audits; the same CLI conventions everywhere means low training overhead.
- Severity handling needs context: the DB is authoritative on CVEs but blind to your exposure (is it reachable?), so triage discipline (does the app actually use that library path? is the service internet-facing?) belongs in the process, not in the tool; severity-only gates with no triage loop produce ignored scanners.
- Operational deployment patterns: scan-in-pipeline (gate merges), scheduled registry sweeps (catch CVEs published after build), and admission-time checks on clusters (Kubernetes admission controllers invoking Trivy); the combination catches the CVE-published-after-deploy window that single-pass scanning misses.
- Positioning within our security-tools set: Trivy (vulnerability/prevention) complements Falco (runtime/detection) and Wazuh (endpoint/SIEM layers); it is the first scanner we deploy on any modern project because the CLI honesty and CI ergonomics beat heavier commercial tooling for the first 80%.
Field note
The CVE that proved the CI-gate habit: a critical advisory published nine days after an image built clean. The scheduled registry re-scan caught it, the rebuild took minutes. A tool with exit codes and a re-scan rhythm is worth ten tools with dashboards nobody opens.
Frequently asked questions
Trivy vs OpenVAS (Greenbone): why do we run both?
Trivy scans artifacts (images, source code, dependencies, IaC) and is CI-shaped; OpenVAS scans live network services on hosts with authenticated probes; they answer different questions and complement rather than compete.
How often does the CVE database update?
Trivy's databases sync continuously from multiple upstream sources (NVD, GHSA, Red Hat, AWS, Debian, etc.); updates are automatic with scheduled cache refresh, and offline mode applies custom DB pulls for air-gapped estates.
What is the .trivyignore pattern?
A file of CVE IDs (optionally with expiry comments) that Trivy skips; the discipline is expiry-dated entries with justification and a quarterly review, treated explicitly as accepted risk rather than silently permanent.
Does scanning at build time cover the risk adequately?
It covers what shipped; CVEs are published continuously, so pair the pipeline gate with scheduled re-scans of running images and admission-time checks in clusters, since the delta between build day and deploy week is where the missed exposure lives.
How Kinetikatech helps with open-source security tools
You shouldn't have to become an expert in open-source security tools: The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology. That's exactly what Penetration Testing and Linux Server Security is for, setup, hardening, monitoring, and a human on call day and night.