StackRadar vs Trivy Operator
Trivy Operator is the free, Apache-2.0 Kubernetes operator from Aqua Security that scans running workloads with Trivy and writes the results into the cluster as custom resources.
Facts last checked . Prices and features change — verify with the vendor before deciding.
What Trivy Operator does well
- Free, open source, and maintained by the company that maintains Trivy itself.
- Nothing leaves the cluster — results are CRDs you read with kubectl.
- Covers more than vulnerabilities: config audit, exposed secrets, RBAC assessment and compliance reports ship in the same operator.
- Prometheus metrics out of the box, so a Grafana dashboard is quick to stand up.
How Trivy Operator and StackRadar differ
The differences are about how the two are built and sold, not a feature checklist. Each point below is a structural fact you can verify on the vendor's own documentation.
- Results are snapshots stored in etcd and expire after 24 hours by default (OPERATOR_SCANNER_REPORT_TTL), then the workload is rescanned. There is no record of what you were exposed to last month.
- Each cluster is a silo. Fleet-wide questions mean one kubeconfig per cluster and an aggregation layer you build and run yourself.
- Severity is CVSS only. Neither EPSS nor the CISA KEV catalogue is used to rank findings.
- Reports are regenerated on every cycle, so there is no triage state: no accepted risk, no suppression with a recorded reason.
- SbomReport CRDs are generated, but a new advisory still means a rescan — the SBOM is not re-matched in place.
Side by side
| Axis | StackRadar | Trivy Operator |
|---|---|---|
| Where it runs | One Helm chart in the cluster, source published; managed dashboard | Operator in the cluster; results as CRDs in etcd |
| Kubernetes runtime inventory | Yes — every running image, with its workload, Helm release and ArgoCD application | Yes — scans running workloads |
| SBOM | CycloneDX 1.6 per running image (Syft), stored and re-checked as new advisories land | SbomReport CRDs (CycloneDX); rescans rather than re-matches |
| Prioritisation | Radar Score — CVSS, EPSS and CISA KEV combined in a published formula | CVSS severity only |
| History and trends | 30 days (Free), 1 year (Pro), 2 years (Business) | None — reports expire (24h default) and are regenerated |
| Multi-cluster view | One dashboard across every cluster in the organisation | None built in; DIY aggregation |
| Scanner source | Published on GitHub; releases signed and version-pinned | Open source (Apache-2.0) |
| Pricing | Published: Free $0 · Pro $59/mo · Business $199/mo | Free; operational cost only |
| Data residency | EU only; only the SBOM leaves the cluster | Stays in your cluster |
Pricing
Trivy Operator: Trivy Operator is free and open source. The cost is operational: someone maintains the operator, tunes report TTLs and scan scopes to keep etcd healthy, and builds whatever aggregation, history and alerting the team needs on top of the CRDs. Aqua sells its commercial platform separately, quote-only.
StackRadar: Free for one cluster with 30 days of history; Pro at $59 per month for up to five clusters and one year of history; Business at $199 per month for up to fifteen clusters and two years. Every plan scans every image you run. Full details on the pricing page.
Which should you choose?
Choose Trivy Operator if
- You run one or two clusters and mainly want to know what is vulnerable right now.
- You have a hard rule that no data may leave the cluster — not even a dependency list.
- You want config, secrets and RBAC checks in the same package.
- Your team already lives in Grafana and the Prometheus metrics are enough.
Choose StackRadar if
- You need one answer across every cluster, not one cluster at a time.
- You need to answer “when did this first appear?” or “what were we exposed to in March?”
- You want findings ranked by real-world exploitability (EPSS, KEV), not CVSS alone.
- You need a dated paper trail for an auditor or an EU regulator (CRA, NIS2).
Frequently asked questions
Is Trivy Operator good enough on its own?
For a single cluster where you want a current snapshot of vulnerabilities and some config checks, yes — it is a genuinely good free answer. It stops being enough when you need history, a multi-cluster view, exploitability-based ranking or a record you can show an auditor.
Can I run Trivy Operator and StackRadar together?
Yes. The two do not conflict. Some teams keep Trivy Operator for config, secrets and RBAC checks inside each cluster and use StackRadar as the one place that tracks vulnerabilities across all of them over time.
Does Trivy Operator keep vulnerability history?
No. VulnerabilityReport objects have a TTL (24 hours by default), after which they are deleted and the workload is rescanned. Anything historical has to be exported and stored by you.
Does Trivy Operator use EPSS or CISA KEV?
Trivy Operator ranks by CVSS severity. EPSS exploitation probability and the CISA Known Exploited Vulnerabilities catalogue are not part of its reports, so a never-exploited 9.8 sorts above a 5.3 that is being exploited today.