.

security/scanning/vulnerability-scanning/references/scanner-comparison.md

@@ -0,0 +1,93 @@
+# Vulnerability Scanner Comparison
+
+## Container Image Scanners
+
+| Tool | License | Speed | Database | CI Integration |
+|------|---------|-------|----------|----------------|
+| **Trivy** | Apache 2.0 | Fast | NVD, Red Hat, etc. | Excellent |
+| **Grype** | Apache 2.0 | Fast | Anchore DB | Good |
+| **Clair** | Apache 2.0 | Medium | NVD, Alpine, etc. | Good |
+| **Snyk** | Commercial | Fast | Snyk DB | Excellent |
+| **Docker Scout** | Commercial | Fast | Docker DB | Native |
+
+## Recommended: Trivy
+
+### Installation
+```bash
+# Homebrew
+brew install trivy
+
+# APT
+apt-get install trivy
+
+# Docker
+docker run aquasec/trivy image nginx:latest
+```
+
+### Basic Usage
+```bash
+# Scan image
+trivy image nginx:latest
+
+# Scan with severity filter
+trivy image --severity HIGH,CRITICAL nginx:latest
+
+# Scan and fail on vulnerabilities
+trivy image --exit-code 1 --severity CRITICAL nginx:latest
+
+# JSON output
+trivy image -f json -o results.json nginx:latest
+
+# Scan filesystem
+trivy fs /path/to/project
+
+# Scan Kubernetes
+trivy k8s --report summary cluster
+```
+
+### GitHub Actions
+```yaml
+- name: Run Trivy vulnerability scanner
+  uses: aquasecurity/trivy-action@master
+  with:
+    image-ref: 'myapp:${{ github.sha }}'
+    format: 'sarif'
+    output: 'trivy-results.sarif'
+    severity: 'CRITICAL,HIGH'
+    
+- name: Upload Trivy scan results
+  uses: github/codeql-action/upload-sarif@v2
+  with:
+    sarif_file: 'trivy-results.sarif'
+```
+
+## Dependency Scanners
+
+| Tool | Languages | License |
+|------|-----------|---------|
+| **npm audit** | JavaScript | Free |
+| **pip-audit** | Python | Free |
+| **bundle audit** | Ruby | Free |
+| **cargo audit** | Rust | Free |
+| **Snyk** | Multi | Commercial |
+| **Dependabot** | Multi | Free (GitHub) |
+| **OWASP Dependency-Check** | Multi | Apache 2.0 |
+
+## Infrastructure as Code Scanners
+
+| Tool | Targets | License |
+|------|---------|---------|
+| **tfsec** | Terraform | MIT |
+| **checkov** | TF, CloudFormation, K8s | Apache 2.0 |
+| **kics** | Multi IaC | Apache 2.0 |
+| **kubesec** | Kubernetes | Apache 2.0 |
+
+## CVSS Score Reference
+
+| Score | Severity |
+|-------|----------|
+| 0.0 | None |
+| 0.1-3.9 | Low |
+| 4.0-6.9 | Medium |
+| 7.0-8.9 | High |
+| 9.0-10.0 | Critical |