JFrog Xray vs Trivy comparison

JFrog and Aqua Security are both solutions in the Container Security category. JFrog is ranked #20 with an average rating of 7.8, while Aqua Security is ranked #7 with an average rating of 8.6. JFrog holds a 3.9% mindshare in Container Security, compared to Aqua Security’s 5.8% mindshare. Additionally, 100% of JFrog users are willing to recommend the solution, compared to 100% of Aqua Security users who would recommend it.

JFrog Xray

Read 8 JFrog Xray reviews

3,038 Views
762 Comparison Views

100% willing to recommend

Trivy

Read 12 Trivy reviews

3,821 Views
755 Comparison Views

100% willing to recommend

JFrog Xray

Trivy

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between JFrog Xray and Trivy based on real PeerSpot user reviews.

Find out in this report how the two Container Security solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed JFrog Xray vs. Trivy Report (Updated: June 2025).

Buyer's Guide

JFrog Xray vs. Trivy

June 2025

Download the complete report

Helped 856,873 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

JFrog Xray

Ranking in Container Security

20th

Average Rating

8.0

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Vulnerability Management (32nd), Software Composition Analysis (SCA) (6th), Software Supply Chain Security (2nd)

Trivy

Ranking in Container Security

7th

Average Rating

8.6

Reviews Sentiment

7.5

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of June 2025, in the Container Security category, the mindshare of JFrog Xray is 3.9%, up from 2.1% compared to the previous year. The mindshare of Trivy is 5.8%, up from 1.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Container Security

Featured Reviews

Sai Pradeep Koneti

DevOps Engineer Intern at University of Nebraska at Omaha

Goes deep into the docker files and find out vulnerabilities

When we were trying to get it up and working initially, I found it a bit hard to go through JFrog Xray's documentation and get my error solved. I was facing some issues because we hadn't got a specific license for the tool, but I was able to access it. As a regular user, I regularly saw an error message saying that the license feature was unavailable for my subscription. After a couple of days, I realized I was missing a license. I had to go back to the JFrog Xray team, who provided me with the new license, and then I could complete the setup.

Read full review

Utsav Sharma

Senior Security Consultant at Ernst & Young

Maintain operational efficiency by detecting misconfigurations and vulnerabilities

The vulnerability scanning feature is excellent as it supports various container capabilities like Docker and Sharma. It also offers repository scanning in the source code domain, allowing pre-push code scans. The misconfiguration detection works well for CloudFormation, Docker files, and Terraform. Its compliance support, like NIST, ensures that configurations align with standards. Trivy helps me significantly detect misconfigurations missed by the ops engineers or in Terraform by the naked eye. It ensures that my deployments are free of misconfigurations and vulnerabilities.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"JFrog Xray's reporting feature has a lot of options in it, including scanning."

"The solution is stable and reliable."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"JFrog Xray shows us a list of vulnerabilities that can impact our code."

"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."

"Good reporting functionalities."

More JFrog Xray pros

"I definitely recommend Trivy."

"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."

"Trivy's ability to scan files, images, GitHub repositories, Infrastructure as Code like Terraform, and Kubernetes is valuable."

"One of the great features of Trivy is that it helps me scan items such as AWS credentials and GCP service accounts."

"It is open-source."

"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."

"It's customizable, allowing me to add any rules and format HTML templates as I wish."

"The most valuable feature of Trivy is its easy integration with the CI/CD pipeline."

More Trivy pros

Cons

"The speed of JFrog Xray should improve. Other solutions have better performance."

"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."

"JFrog Xray's documentation and error logging could be improved."

"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."

"Lacks deeper reporting, the ability to compare things."

"X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL."

"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."

"Since we have been using the solution via APIs, there are some limitations in the APIs."

More JFrog Xray cons

"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."

"One drawback I have observed with Trivy is the difficulty in building or integrating a UI, particularly for an operator in the NetSuite example."

"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."

"Trivy generates many false positives, flagging non-existent vulnerabilities. Improvements could include better contextual analysis or granular filtering."

"Trivy can improve by providing an output in PDF format."

"Having little experience can hinder the ability to connect it to a user-friendly UI effectively."

"A dynamic scanning capability during runtime would be a significant advantage."

More Trivy cons

See which vendors are best for you

Use our free recommendation engine to learn which Container Security solutions are best for your needs.

See recommendations

856,873 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

25%

Computer Software Company

12%

Manufacturing Company

11%

Government

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about JFrog Xray?

JFrog Xray shows us a list of vulnerabilities that can impact our code.

See all answers

What needs improvement with JFrog Xray?

X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL. More support during troubleshooting sessions would also be beneficial.

See all answers

What is your primary use case for JFrog Xray?

Our primary use case for X-ray includes multiple activities such as security and vulnerability scanning. We already use Black Duck for these purposes, and we are evaluating how JFrog Xray can offer...

See all answers

What needs improvement with Trivy?

Trivy's marketing and awareness need improvement. Not everyone knows about it, which isn't ideal given its capabilities. There's potential to integrate AI and machine learning for enhanced function...

See all answers

What is your primary use case for Trivy?

I use Trivy ( /products/trivy-reviews ) to scan code for vulnerabilities before deployment. Our projects, which are developed by different developers, involve various dependencies and third-party c...

See all answers

What advice do you have for others considering Trivy?

I recommend Trivy to others due to its powerful and useful features. However, I suggest increasing its marketing to raise awareness. I rate Trivy an eight out of ten.

See all answers

Comparisons

Black Duck vs JFrog Xray

Compared 14% of the time

Veracode vs JFrog Xray

Compared 6% of the time

Prisma Cloud by Palo Alto Networks vs JFrog Xray

Compared 6% of the time

GitHub Dependabot vs JFrog Xray

Compared 6% of the time

Wiz vs JFrog Xray

Compared 5% of the time

More JFrog Xray Competitors

Snyk vs Trivy

Compared 23% of the time

Wiz vs Trivy

Compared 8% of the time

Kubescape vs Trivy

Compared 7% of the time

Prisma Cloud by Palo Alto Networks vs Trivy

Compared 6% of the time

SUSE NeuVector vs Trivy

Compared 6% of the time

More Trivy Competitors

Product Reports

Buyer's Guide

JFrog Xray

June 2025

Download JFrog Xray product report

Buyer's Guide

Trivy

May 2025

Download Trivy product report

Also Known As

JFrog Security Essentials

No data available

Overview

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

If you are a team player and you care and you play to WIN, we have just the job you're looking for.

As we say at JFrog: "Once You Leap Forward You Won't Go Back!"

JFrog

Trivy is a versatile tool for scanning container images and identifying vulnerabilities, favored for its integration with CI/CD pipelines and ease of use. It supports scanning both operating system packages and application dependencies.

Trivy is an efficient tool designed to automate security checks and ensure compliance. Its quick setup, detailed analysis capabilities, and support for multiple programming languages and environments make it a reliable choice for users. Trivy provides comprehensive scanning and integration with CI/CD pipelines, resulting in accurate vulnerability detection and a smoother workflow for developers.

What are the most important features?

Efficient vulnerability detection: Quickly identifies vulnerabilities in container images.
Comprehensive scanning: Supports scanning of both OS packages and application dependencies.
CI/CD pipeline integration: Seamlessly integrates with CI/CD tools for automated security checks.
Broad language support: Handles multiple programming languages and environments.
Ease of use: Simple setup and user-friendly interface.

What benefits or ROI should users look for?

Improved security: Regular and thorough vulnerability scanning enhances security posture.
Compliance maintenance: Helps in maintaining compliance with security policies and regulations.
Cost efficiency: Automation reduces the time and cost associated with manual security checks.
Integration flexibility: Efficiently integrates with existing CI/CD pipelines to streamline workflows.
Detailed reporting: Provides comprehensive reports for better decision-making.

Trivy is widely used in industries with a focus on maintaining high security standards such as finance, healthcare, and technology sectors. Its ability to detect vulnerabilities quickly and integrate with CI/CD pipelines makes it an essential tool for ensuring secure and compliant software development practices in these industries. Continuous improvements in speed, documentation, and integration could further enhance its value.

Aqua Security

Sample Customers

google, amazon, cisco, netflix, oracle, vmware, facebook

Information Not Available

Buyer's Guide

JFrog Xray vs. Trivy

June 2025

Free Report: JFrog Xray vs. Trivy

Find out what your peers are saying about JFrog Xray vs. Trivy and other solutions. Updated: June 2025.

DOWNLOAD NOW

856,873 professionals have used our research since 2012.

See our JFrog Xray vs. Trivy report.

See our list of best Container Security vendors.

We monitor all Container Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.