TL;DR
Trivy is an open-source security tool that comprehensively scans containers, Kubernetes, code repositories, and more for vulnerabilities, misconfigurations, secrets, and licenses.
Key features
Scan diverse targets: Supports container images, filesystems, Git repositories (remote), VM images, and Kubernetes clusters
Multiple scanners: OS packages and software dependencies (SBOM), known vulnerabilities (CVE), IaC misconfigurations, sensitive information/secrets, and software license detection
Broad language/platform support: Supports most programming languages and operating systems
Various deployment methods: Homebrew, Docker, binary download, GitHub Actions, VS Code plugin, Kubernetes operator, etc.
SBOM generation: Can generate a software bill of materials
When to use it
To automatically check security vulnerabilities in container images or code repositories in CI/CD pipelines
To periodically check for misconfigurations and vulnerabilities in Kubernetes clusters
To proactively detect secret exposure in local filesystems or Git repositories during development
To assess the security posture of VM images or verify software license compliance