JFrog Xray vs Trivy comparison

JFrog and Aqua Security are both solutions in the Container Security category. JFrog is ranked #22 with an average rating of 8.0, while Aqua Security is ranked #16 with an average rating of 8.6. JFrog holds a 3.9% mindshare in Container Security, compared to Aqua Security’s 5.7% mindshare. Additionally, 100% of JFrog users are willing to recommend the solution, compared to 100% of Aqua Security users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between JFrog Xray and Trivy based on real PeerSpot user reviews.

Find out in this report how the two Container Security solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed JFrog Xray vs. Trivy Report (Updated: April 2025).

Buyer's Guide

JFrog Xray vs. Trivy

April 2025

Download the complete report

Helped 849,686 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of May 2025, in the Container Security category, the mindshare of SentinelOne Singularity Cloud Security is 2.4%, up from 1.0% compared to the previous year. The mindshare of JFrog Xray is 3.9%, up from 2.0% compared to the previous year. The mindshare of Trivy is 5.7%, up from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Container Security

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Mokshi Pandita

DevOps Engineer at Rambøll Danmark A/S

An intelligent solution that prioritizes which vulnerability to target first in your project

We could create any number of repositories, but we can create only thirty projects with JFrog Xray. If I want things to work, it has to be one project and multiple repositories that belong to different real projects. So I have a limitation of thirty projects, despite being a premium customer. JFrog Xray does not have a dashboard. Although I am able to generate reports, there is no proper dashboard where I can see the total number of vulnerabilities, the total number of license issues, and how many vulnerabilities are fixed. Second, I found the shift left approach missing with JFrog Xray. JFrog Xray has integration with IDEs, but it does not tell you about the vulnerabilities until the artifact is created. However, Snyk could directly integrate with your repository and would not allow you to build unless you fix the problem.

Read full review

Utsav Sharma

Senior Security Consultant at Ernst & Young

Maintain operational efficiency by detecting misconfigurations and vulnerabilities

The vulnerability scanning feature is excellent as it supports various container capabilities like Docker and Sharma. It also offers repository scanning in the source code domain, allowing pre-push code scans. The misconfiguration detection works well for CloudFormation, Docker files, and Terraform. Its compliance support, like NIST, ensures that configurations align with standards. Trivy helps me significantly detect misconfigurations missed by the ops engineers or in Terraform by the naked eye. It ensures that my deployments are free of misconfigurations and vulnerabilities.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature is the easy-to-understand user interface, which allows even non-technical users to comprehend and resolve issues."

"Cloud Native Security helps us discover vulnerabilities in a cloud environment like open ports that allow people to attack our environment. If someone unintentionally opens a port, we are exposed. Cloud Native Security alerts us so we can remediate the problem. We can also automate it so that Cloud Native Security will fix it."

"With SentinelOne Singularity Cloud Security, it's easy to onboard new accounts."

"We've seen a reduction in resources devoted to vulnerability monitoring. Before SentinelOne Singularity Cloud Security we spent a lot of time monitoring and fixing these issues. SentinelOne Singularity Cloud Security enabled us to divert more resources to the production environment."

"It is pretty easy to integrate with this platform. When properly integrated, it monitors end-to-end."

"SentinelOne stands out with its responsiveness to feature requests for Singularity Cloud Security."

"SentinelOne Singularity Cloud Security offers security solutions for both Kubernetes and CI/CD pipelines."

"Singularity Cloud Workload Security provides us with better security detection and more visibility. It is another resource that we can use to detect vulnerabilities in our company's systems. For example, it can help us detect new file processes that we are not familiar with, which could be used by attackers to exploit our systems. Singularity Cloud Workload Security can also help us diagnose and analyze data to determine whether it is malicious or not. Singularity Cloud Workload Security is like another pair of eyes that can help us protect our systems from cyberattacks."

More SentinelOne Singularity Cloud Security pros

"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."

"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"JFrog Xray's reporting feature has a lot of options in it, including scanning."

"JFrog Xray shows us a list of vulnerabilities that can impact our code."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."

"Good reporting functionalities."

More JFrog Xray pros

"Trivy is particularly useful for checking if Docker images have critical vulnerabilities before they reach production."

"I definitely recommend Trivy."

"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."

"One of the great features of Trivy is that it helps me scan items such as AWS credentials and GCP service accounts."

"Trivy is very reliable and always has an up-to-date database to scan images and identify vulnerabilities."

"Trivy's open source nature and wide functionality are incredibly valuable."

"I appreciate Trivy for being open-source and not requiring any payment."

"The most valuable feature of Trivy is its easy integration with the CI/CD pipeline."

More Trivy pros

Cons

"One potential drawback is the cost of SentinelOne Singularity Cloud Security, which may be prohibitive for smaller businesses or startups, particularly those in regions with lower average incomes, such as India."

"here is a bit of a learning curve. However, you only need two to three days to identify options and get accustomed."

"I would like to see the map feature improve. It's good, but it isn't fully developed. It lets us use custom resources and policies but does not allow us to perform some actions. I would also like more custom integration and runtime security for Kubernetes."

"One area for improvement could be the internal analysis process, specifically the guidance provided for remediation."

"One of our use cases was setting up a firewall for our endpoints, specifically for our remote users... We were hoping to utilize SentinelOne's firewall capabilities, but there were limitations on how many URLs we could implement. Because of those limitations on the number of URLs, we weren't able to utilize that feature in the way we had hoped to."

"Crafting customized policies can be tricky."

"I used to work on AWS. At times, I would generate a normal bug in my system, and then I would check SentinelOne Singularity Cloud Security. The alert used to come after about three and a half hours. It used to take that long to generate the alert about the vulnerability in my system. If a hacker attacks a system and SentinelOne Singularity Cloud Security takes three to four hours to generate an alert, it will not be beneficial for the company. It would be helpful if we get the alert in five to ten minutes."

"A vulnerability alert would appear, and we'd fix it, but then the same alert would return the next day."

More SentinelOne Singularity Cloud Security cons

"The speed of JFrog Xray should improve. Other solutions have better performance."

"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."

"Since we have been using the solution via APIs, there are some limitations in the APIs."

"Lacks deeper reporting, the ability to compare things."

"X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL."

"JFrog Xray's documentation and error logging could be improved."

"JFrog Xray does not have a dashboard."

"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."

More JFrog Xray cons

"The reporting could be a little better."

"For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools. That would be my suggestion."

"One drawback I have observed with Trivy is the difficulty in building or integrating a UI, particularly for an operator in the NetSuite example."

"The reporting could be a little better. When integrating Trivy with CI, the interpretation of the reports could be improved."

"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."

"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."

"Trivy generates many false positives, flagging non-existent vulnerabilities. Improvements could include better contextual analysis or granular filtering."

"Having little experience can hinder the ability to connect it to a user-friendly UI effectively."

More Trivy cons

Pricing and Cost Advice

"I understand that SentinelOne is a market leader, but the bill we received was astronomical."

"Singularity Cloud Security by SentinelOne is cost-efficient."

"The pricing is somewhat high compared to other market tools."

"For pricing, it currently seems to be in line with market rates."

"SentinelOne is quite costly compared to other security platforms."

"SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven."

"The pricing is fair. It is not inexpensive, and it is also not expensive. When managing a large organization, it is going to be costly, but it meets the business needs. In terms of what is out there on the market, it is fair and comparable to what I have seen, so I do not have any complaints about the cost"

"The cost for PingSafe is average when compared to other CSPM tools."

More SentinelOne Singularity Cloud Security pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Container Security solutions are best for your needs.

See recommendations

849,686 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

17%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

26%

Computer Software Company

13%

Manufacturing Company

12%

Government

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

It is cost-effective compared to other solutions in the market.

See all answers

What needs improvement with PingSafe?

SentinelOne Singularity Cloud Security is an excellent CSPM tool, but its CWPP features need improvement, and there i...

See all answers

What do you like most about JFrog Xray?

JFrog Xray shows us a list of vulnerabilities that can impact our code.

See all answers

What needs improvement with JFrog Xray?

X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL. More support ...

See all answers

What is your primary use case for JFrog Xray?

Our primary use case for X-ray includes multiple activities such as security and vulnerability scanning. We already u...

See all answers

What needs improvement with Trivy?

One drawback I have observed with Trivy is the difficulty in building or integrating a UI, particularly for an operat...

See all answers

What is your primary use case for Trivy?

The main use case for Trivy is to scan Docker images or packages for CVEs, specifically for vulnerabilities. I use th...

See all answers

What advice do you have for others considering Trivy?

I rate Trivy an eight out of ten. This rating reflects its open-source nature, comprehensive scanning capabilities, a...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 24% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 19% of the time

AWS GuardDuty vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 5% of the time

More SentinelOne Singularity Cloud Security Competitors

Black Duck vs JFrog Xray

Compared 15% of the time

Veracode vs JFrog Xray

Compared 6% of the time

Prisma Cloud by Palo Alto Networks vs JFrog Xray

Compared 6% of the time

GitHub Dependabot vs JFrog Xray

Compared 6% of the time

Wiz vs JFrog Xray

Compared 5% of the time

More JFrog Xray Competitors

Snyk vs Trivy

Compared 23% of the time

Wiz vs Trivy

Compared 8% of the time

Kubescape vs Trivy

Compared 7% of the time

Prisma Cloud by Palo Alto Networks vs Trivy

Compared 6% of the time

SUSE NeuVector vs Trivy

Compared 5% of the time

More Trivy Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

April 2025

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

JFrog Xray

April 2025

Download JFrog Xray product report

Buyer's Guide

Container Security

April 2025

Download Trivy product report

Also Known As

PingSafe

JFrog Security Essentials

No data available

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

SentinelOne

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

If you are a team player and you care and you play to WIN, we have just the job you're looking for.

As we say at JFrog: "Once You Leap Forward You Won't Go Back!"

JFrog

Trivy is a versatile tool for scanning container images and identifying vulnerabilities, favored for its integration with CI/CD pipelines and ease of use. It supports scanning both operating system packages and application dependencies.

Trivy is an efficient tool designed to automate security checks and ensure compliance. Its quick setup, detailed analysis capabilities, and support for multiple programming languages and environments make it a reliable choice for users. Trivy provides comprehensive scanning and integration with CI/CD pipelines, resulting in accurate vulnerability detection and a smoother workflow for developers.

What are the most important features?

Efficient vulnerability detection: Quickly identifies vulnerabilities in container images.
Comprehensive scanning: Supports scanning of both OS packages and application dependencies.
CI/CD pipeline integration: Seamlessly integrates with CI/CD tools for automated security checks.
Broad language support: Handles multiple programming languages and environments.
Ease of use: Simple setup and user-friendly interface.

What benefits or ROI should users look for?

Improved security: Regular and thorough vulnerability scanning enhances security posture.
Compliance maintenance: Helps in maintaining compliance with security policies and regulations.
Cost efficiency: Automation reduces the time and cost associated with manual security checks.
Integration flexibility: Efficiently integrates with existing CI/CD pipelines to streamline workflows.
Detailed reporting: Provides comprehensive reports for better decision-making.

Trivy is widely used in industries with a focus on maintaining high security standards such as finance, healthcare, and technology sectors. Its ability to detect vulnerabilities quickly and integrate with CI/CD pipelines makes it an essential tool for ensuring secure and compliant software development practices in these industries. Continuous improvements in speed, documentation, and integration could further enhance its value.

Aqua Security

Sample Customers

Information Not Available

google, amazon, cisco, netflix, oracle, vmware, facebook

Information Not Available

Buyer's Guide

JFrog Xray vs. Trivy

April 2025

Free Report: JFrog Xray vs. Trivy

Find out what your peers are saying about JFrog Xray vs. Trivy and other solutions. Updated: April 2025.

DOWNLOAD NOW

849,686 professionals have used our research since 2012.

See our JFrog Xray vs. Trivy report.

See our list of best Container Security vendors.

We monitor all Container Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.