Container vulnerability scanning tools in 2026, by job

Most "best container scanner" lists rank ten tools against each other as if they did the same job. They do not. A container vulnerability scanner is asked one of three questions: is this image clean enough to ship, what is in this registry, or which running workloads does this CVE affect. A tool that is excellent at one is often not built for the others.

This post sorts the tools by job, says where each one stops, and gives our own two tools the same scrutiny. Licences, prices and features were checked in September 2026; the comparison pages go deeper per product.

Which tool for which job

The third job is the one the first two cannot do. A cluster runs many images nobody in your pipeline built (ingress controllers, agents, sidecars, CSI drivers), and an image that was clean when CI scanned it acquires new CVEs every week it keeps running.

Job 1: scanning an image in CI

Trivy: the default, if you pin it

Trivy (Aqua Security, Apache-2.0) is the default answer and deserves to be. One binary scans images, filesystems, git repositories, IaC, Kubernetes manifests and secrets, and it can re-scan an SBOM file with trivy sbom. If you have no scanner in CI today, add Trivy and move on.

trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/shop/checkout:1.42.0

Pin it properly. In March 2026 attackers force-pushed most trivy-action release tags to a credential stealer and briefly published a malicious Trivy binary (v0.69.4) and images (GHSA-69fq-xp46-6x23). Aqua's own advice holds for every scanner in this list: reference GitHub Actions by commit SHA, not by tag.

Where it stops: Trivy is a scanner, not a system. It has no memory between runs, so "is there a new CVE in the image we shipped last month?" needs a rescan you schedule yourself. Findings are ranked by severity only; EPSS and KEV are not in its output, so teams bolt them on afterwards.

Grype (with Syft): the best CI ranking

Grype (Anchore, Apache-2.0) is the matcher half of a pair; Syft generates the SBOM. The design is the reason to choose it: generate the SBOM once, attach it to the image, and scan the SBOM rather than the image every time you want a fresh answer. Grype also prints EPSS, KEV status and a composite risk score for each finding, which makes its output the best ranked of the free CI scanners.

syft registry.example.com/shop/checkout:1.42.0 -o cyclonedx-json > checkout.cdx.json
grype sbom:checkout.cdx.json --fail-on high

Where it stops: images, filesystems and SBOMs only; no IaC, no secrets, no Kubernetes awareness. It is as stateless as Trivy: the SBOM-first workflow makes re-matching cheap, but the scheduling and storage are yours to build. Anchore sells that layer as Anchore Enterprise.

OSV-Scanner

OSV-Scanner (Google, Apache-2.0) matches against OSV.dev directly. Version 2 (March 2025) made container scanning first-class, layer-aware for Debian, Ubuntu and Alpine images, and it is strongest on language ecosystems, where OSV's advisories come straight from sources such as the Go, PyPI and RustSec databases. Distro coverage outside those three is thinner than Trivy's and Grype's. It is also the library inside the StackRadar CLI.

StackRadar CLI

stackradar scan (Apache-2.0) scans a single image with --image, or every image a cluster is running, and has a --fail-on kev gate, so CI fails on CVEs that are being exploited rather than on "anything critical". It needs no account and sends no telemetry.

stackradar scan --image registry.example.com/shop/checkout:1.42.0 --fail-on kev

Where it stops: it inherits osv-scanner's distro coverage, has no EPSS column yet, and does no IaC, secrets or config scanning. For CI-only image scanning it is a reasonable choice, not a clearly better one than Trivy or Grype. The launch post lists its limits.

Job 2: scanning a registry

Docker Scout

Docker Scout analyses images on Docker Hub and, through integrations, ECR, ACR, Artifactory, Harbor and Nexus. Results show in Docker Desktop, the Hub UI and the CLI, whose --epss and --only-cisa-kev flags add exploitation data, and its base-image update recommendations are genuinely useful. Continuous analysis is free for one repository on Docker Personal and two on Pro; unlimited repositories need the per-user Team or Business plan. If your images live on Docker Hub, it is the least friction you will find. Head-to-head.

Where it stops: it knows the registry, not the cluster. Its environment tracking only knows what your pipeline tells it was deployed; it does not watch a cluster, so sidecars, operators and images from other registries are invisible to it.

Snyk Container

Snyk Container integrates with most registries and CI systems, opens base-image upgrade pull requests, and has the best developer-facing UX of the group. Its Risk Score blends CVSS, EPSS and exploit maturity. It is priced per contributing developer; the free plan allows 100 container tests a month, which a busy pipeline uses up fast. It fits best where the organisation already pays for Snyk Open Source or Code.

Where it stops: importing workloads from a running Kubernetes cluster is an Enterprise-plan feature, so on Free and Team it is a pipeline and registry tool. See the head-to-head.

Registry-native scanners

ECR (basic scanning, or enhanced scanning through Amazon Inspector), Google Artifact Registry, ACR through Defender for Cloud, Harbor (bundles Trivy) and GitLab's container registry all scan on push. They are the right answer when "what did we push?" is the whole question. They are the wrong answer when you need one view across three clouds, or anything about what is running.

Job 3: scanning what is running

Trivy Operator: the free default for one cluster

Trivy Operator watches workloads in one cluster, scans them with Trivy, and writes the results as custom resources (VulnerabilityReport, SbomReport, ConfigAuditReport and more) you read with kubectl. It is free, actively released (v0.34.0 in August 2026), keeps every result inside the cluster, and covers configuration, exposed secrets and RBAC as well as vulnerabilities. For one or two clusters and a "what is vulnerable right now?" question it is the tool we recommend most often, including on its own comparison page.

Where it stops: reports live in etcd with a 24-hour TTL by default and are regenerated by rescanning, so there is no history and no fleet view without an aggregation layer you build. Ranking is CVSS only. The StackRadar vs Trivy Operator post covers the trade-off in detail.

Kubescape: when posture is the bigger problem

Kubescape (a CNCF incubating project since January 2025, created by ARMO, Apache-2.0) is primarily a posture tool: NSA/CISA and CIS frameworks, misconfiguration scanning, RBAC. Its operator also scans images in-cluster, stores results as CRDs, rescans daily, and can use eBPF to mark which vulnerable packages are actually loaded at runtime, which StackRadar does not do. ARMO sells a hosted platform on top, now quote-only. Choose Kubescape when posture is the larger problem, or when runtime relevancy is a requirement. Head-to-head.

StackRadar: when you need the fleet and the history

StackRadar is an open-source (Apache-2.0) in-cluster scanner plus a managed dashboard. The scanner generates a CycloneDX SBOM per running image with Syft and uploads only that. StackRadar keeps the SBOM and re-matches it as advisories land, so a new CVE becomes a finding without a rescan. Every cluster is in one view, findings are attributed to workloads, Helm releases and ArgoCD applications, history is kept (30 days on Free, up to two years on paid plans), and the Radar Score ranks findings by likelihood × consequence, with EPSS and KEV driving the likelihood.

Where it stops: vulnerabilities only. No configuration audit, no RBAC assessment and no runtime detection, all of which Trivy Operator or Kubescape give you. The hosted product does not scan in CI; the CLI covers that. The scanner is Apache-2.0, but the dashboard it reports to is a hosted service in the EU, which rules it out for teams whose data may not leave the cluster.

The CNAPP platforms

Wiz, Sysdig, Aqua, Defender for Containers and Prisma Cloud all scan running clusters as one feature of a much larger product: cloud posture, runtime detection, identity. They are the right answer for a security organisation consolidating a dozen tools, and the wrong one for a platform team that wants one question answered. Most are quote-only and priced per node or workload, so a mid-sized fleet is usually a five-figure annual contract.

All of them, in one table

A plain recommendation

• No scanner yet: Trivy in CI today, with the action pinned by SHA.
• Already producing SBOMs, or want EPSS and KEV in CI output: Grype against them.
• Images on Docker Hub: Docker Scout, before anything else.
• One or two clusters, no history requirement: Trivy Operator.
• Posture and misconfiguration matter as much as CVEs: Kubescape.
• Need "which pods, in which clusters, and what changed since March?" answered without rescanning: something that keeps the SBOM. That is StackRadar, or the equivalent you build on Syft and a database.
• Need posture, runtime and vulnerabilities from one vendor: a CNAPP, with a budget.

Frequently asked questions