DevOps-Security-Agent-Skills/security/scanning/vulnerability-scanning/references/scanner-comparison.md

Vulnerability Scanner Comparison

Container Image Scanners

Tool	License	Speed	Database	CI Integration
Trivy	Apache 2.0	Fast	NVD, Red Hat, etc.	Excellent
Grype	Apache 2.0	Fast	Anchore DB	Good
Clair	Apache 2.0	Medium	NVD, Alpine, etc.	Good
Snyk	Commercial	Fast	Snyk DB	Excellent
Docker Scout	Commercial	Fast	Docker DB	Native

Recommended: Trivy

Installation

# Homebrew
brew install trivy

# APT
apt-get install trivy

# Docker
docker run aquasec/trivy image nginx:latest

Basic Usage

# Scan image
trivy image nginx:latest

# Scan with severity filter
trivy image --severity HIGH,CRITICAL nginx:latest

# Scan and fail on vulnerabilities
trivy image --exit-code 1 --severity CRITICAL nginx:latest

# JSON output
trivy image -f json -o results.json nginx:latest

# Scan filesystem
trivy fs /path/to/project

# Scan Kubernetes
trivy k8s --report summary cluster

GitHub Actions

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:${{ github.sha }}'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    
- name: Upload Trivy scan results
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: 'trivy-results.sarif'

Dependency Scanners

Tool	Languages	License
npm audit	JavaScript	Free
pip-audit	Python	Free
bundle audit	Ruby	Free
cargo audit	Rust	Free
Snyk	Multi	Commercial
Dependabot	Multi	Free (GitHub)
OWASP Dependency-Check	Multi	Apache 2.0

Infrastructure as Code Scanners

Tool	Targets	License
tfsec	Terraform	MIT
checkov	TF, CloudFormation, K8s	Apache 2.0
kics	Multi IaC	Apache 2.0
kubesec	Kubernetes	Apache 2.0

CVSS Score Reference

Score	Severity
0.0	None
0.1-3.9	Low
4.0-6.9	Medium
7.0-8.9	High
9.0-10.0	Critical