Try our new research platform with insights from 80,000+ expert users

Orca Security vs Trivy comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Orca Security
Ranking in Container Security
10th
Average Rating
9.0
Reviews Sentiment
6.9
Number of Reviews
30
Ranking in other categories
Vulnerability Management (11th), Cloud Workload Protection Platforms (CWPP) (5th), API Security (4th), Cloud Security Posture Management (CSPM) (6th), Cloud-Native Application Protection Platforms (CNAPP) (5th), Data Security Posture Management (DSPM) (8th), Cloud Detection and Response (CDR) (2nd), AI Security (5th)
Trivy
Ranking in Container Security
4th
Average Rating
8.6
Reviews Sentiment
7.5
Number of Reviews
12
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of March 2026, in the Container Security category, the mindshare of Orca Security is 4.0%, down from 4.7% compared to the previous year. The mindshare of Trivy is 4.5%, down from 4.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security Mindshare Distribution
ProductMindshare (%)
Trivy4.5%
Orca Security4.0%
Other91.5%
Container Security
 

Featured Reviews

reviewer2800203 - PeerSpot reviewer
Assistant Manager at a manufacturing company with 10,001+ employees
Cloud posture management has improved remediation and optimizes costs with contextual risk insights
Since I have not used Orca Security for 10 months, I am uncertain what areas still need improvement, as they may have rolled out features that addressed issues I faced in the past. However, I can say the tool is good. A few things could potentially be improved, particularly regarding false positives and the UI. What I observed is that they release updates to the platform without notifying the customer. Every time the UI is upgraded, they release something without notification. This could be a slight improvement. If they released some kind of notification to just inform the customer about UI changes, the customer would be aware of the changes that Orca Security is making in the backend.
ST
Software Engineer at a tech vendor with 10,001+ employees
Consistently maintains vulnerability-free images and integrates effectively with builds
Trivy is very reliable and always has an up-to-date database to scan images and identify vulnerabilities. I integrated it with Jenkins jobs, so every time we run a build, if there is a high, critical, or medium vulnerability, the build is set to fail. This ensures that somebody resolves the issues before the code progresses. This approach helps keep every image in every project we work on vulnerability-free.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Orca Security has helped reduce the time it takes to address cloud security alerts."
"The best features of Orca Security include its ability to perform a lot of security controls without requiring any installation of agents, making it very easy to set up."
"Orca Security has updated its interface, making it more user-friendly. I find it particularly useful as it allows me to easily navigate the dashboard and prioritize actions based on severity and criticality."
"Orca Security is the best one for me because it delivers all the things that I need and more."
"The product itself is really good. It helped us streamline the way we access our servers."
"The vulnerability management does not require network scanning or agent technology, so I don't need to modify any of my products in order to do vulnerability assessments."
"Orca's dashboard is excellent. My team needs to be able to focus on specific areas for improvement in our cloud environment. And most recently, we've started to get good use out of sonar, the search capabilities, and the alert creation."
"I appreciate Orca Security because I can see CSPM, KSPM, and DSPM, and it works with major security frameworks such as NIST and CIS, allowing me to see comprehensive insights on my cloud environment, with CI/CD integration and shift-left configuration that helps me improve cloud maturity and DevSecOps maturity as a complete CNAPP platform with the most capabilities to work with cloud security."
"Trivy is most valuable for its ability to scan all repository files and dependencies."
"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."
"It's customizable, allowing me to add any rules and format HTML templates as I wish."
"It is open-source."
"I can see vulnerabilities in the images of any applications deployed in the Kubernetes environment or as container applications."
"Overall, I would rate Trivy a ten out of ten."
"Trivy is particularly useful for checking if Docker images have critical vulnerabilities before they reach production."
"Trivy's open source nature and wide functionality are incredibly valuable."
 

Cons

"A notable limitation with Orca Security is its scanning feature. The automatic scan only runs every 24 hours, and if an alert is remediated within an hour, it still remains until the next scheduled scan."
"The main drawback in an agentless approach is that if the solution detects a virus or malware in the environment, we need to manually remove it. But from my experience with other production environments, it's not straightforward to install agents in the hope they will automatically remediate viruses, even from production environments... Ultimately, the ability to auto-remediate is something that I would like to see."
"I think Orca could give me more alerts. It could give me a dashboard with all the specific types of alerts I want to see for the day. It should just be one click."
"Orca Security can be improved as there should be some kind of central pane of glass. Similar to how cloud management works, Orca Security should have something comparable."
"Orca Security can be improved as there should be some kind of central pane of glass. Similar to how cloud management works, Orca Security should have something comparable."
"The documentation for Orca Security could be improved."
"We are PCI DSS compliant, so we need to scan our environment externally with tools vetted by the PCI DSS organization. Orca doesn't scan the environment externally. It only scans what's currently in the cloud."
"The problem with the Orca Security technical support team and customer service team is that Orca Security is a medium company and I think they do not have a large team."
"The reporting could be a little better."
"Trivy can improve by providing an output in PDF format."
"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."
"The reporting could be a little better. When integrating Trivy with CI, the interpretation of the reports could be improved."
"Trivy can improve by providing an output in PDF format. Additionally, it takes longer to scan container images built with many layers."
"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."
"Trivy is not scalable; however, I have scanned very large projects with it. It is stable but not scalable according to my experience."
"Trivy generates many false positives, flagging non-existent vulnerabilities."
 

Pricing and Cost Advice

"The pricing depends on how many assets you have running in your cloud and how many environments you have. If you have a dev environment, test environment, and a production environment then it's really important that you have coverage for all of them."
"It is the cost of the visibility that you get. When you really sit down and think about what do you need to do to secure an environment with a low impact on the business, and you take a look out into the world, I think this tool is well justified around cost."
"We have a total of 25 licenses for this solution. The solution is on a pay-and-you-use model."
"I think their pricing model is aligned with market demand. Of course, Orca could probably better align their pricing model with the needs of smaller businesses as well as some larger-scale enterprises with millions of assets. But in all fairness, I think the Orca sales team has been accommodating and ensured that we're happy with the pricing."
"Orca Security is cheaper compared to other solutions in the same space."
"Overall, the pricing is reasonable and the discounts have been acceptable."
"The most expensive solution is Palo Alto. They claim to be very robust. The next most expensive is Wiz, followed by Orca and all the rest."
"Orca Security charges are based on cloud workloads. So, it's based on workloads. If we look at one feature, it might be expensive."
Information not available
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
884,873 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
12%
Manufacturing Company
10%
Healthcare Company
5%
Financial Services Firm
13%
Manufacturing Company
11%
Computer Software Company
11%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise8
Large Enterprise8
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise1
Large Enterprise9
 

Questions from the Community

What do you like most about Orca Security?
It's for protection. It's an agentless tool. We don't need to install anything at a customer's premises. We can just scan the entire assets in the cloud.
What needs improvement with Orca Security?
I think the downside of Orca Security is the reports. I don't have any good reports ready to deliver to an executive. If I need to deliver some reports to my account manager or an executive, I don'...
What is your primary use case for Orca Security?
I normally use Orca Security for AppSec, and one of the features that I use commonly is the application security. I love it because it's already covered in the same license, and I can get a good ov...
What needs improvement with Trivy?
Trivy's marketing and awareness need improvement. Not everyone knows about it, which isn't ideal given its capabilities. There's potential to integrate AI and machine learning for enhanced function...
What is your primary use case for Trivy?
I use Trivy ( /products/trivy-reviews ) to scan code for vulnerabilities before deployment. Our projects, which are developed by different developers, involve various dependencies and third-party c...
What advice do you have for others considering Trivy?
I recommend Trivy to others due to its powerful and useful features. However, I suggest increasing its marketing to raise awareness. I rate Trivy an eight out of ten.
 

Comparisons

 

Overview

 

Sample Customers

BeyondTrust, Postman, Digital Turbine, Solarisbank, Lemonade, C6 Bank, Docebo, Vercel, and Vivino
Information Not Available
Find out what your peers are saying about Orca Security vs. Trivy and other solutions. Updated: March 2026.
884,873 professionals have used our research since 2012.