Try our new research platform with insights from 80,000+ expert users

JFrog Xray vs Trivy comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

SentinelOne Singularity Clo...
Sponsored
Ranking in Container Security
3rd
Average Rating
8.8
Reviews Sentiment
7.9
Number of Reviews
114
Ranking in other categories
Vulnerability Management (6th), Cloud and Data Center Security (4th), Cloud Workload Protection Platforms (CWPP) (4th), Cloud Security Posture Management (CSPM) (3rd), Cloud-Native Application Protection Platforms (CNAPP) (3rd), Compliance Management (2nd)
JFrog Xray
Ranking in Container Security
23rd
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
8
Ranking in other categories
Vulnerability Management (30th), Software Composition Analysis (SCA) (7th), Software Supply Chain Security (3rd)
Trivy
Ranking in Container Security
9th
Average Rating
8.6
Reviews Sentiment
7.5
Number of Reviews
12
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2025, in the Container Security category, the mindshare of SentinelOne Singularity Cloud Security is 2.4%, up from 1.0% compared to the previous year. The mindshare of JFrog Xray is 3.9%, up from 2.0% compared to the previous year. The mindshare of Trivy is 5.7%, up from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security
 

Featured Reviews

Akshay Sankpal - PeerSpot reviewer
Excellent defense, minimal performance impact, and great customer service
It has helped us a lot with security practices which are supported by the industry benchmarks. The security tools and policies are regularly updated based on new evidence or changing threat landscapes. Furthermore, after SentinelOne Singularity Cloud Security was deployed in our system, it provided quick alerts. Previously, tools did not offer fast notifications in case of incidents. SentinelOne Singularity Cloud Security delivers alerts in seconds or milliseconds. It connects directly with my dashboard. I can see the issue. They also provide critical documentation, helping me address issues. It has improved our risk posture significantly. The risk posture improved from 60% to 70% to 90% to 95%. We have better control over the risk posture. It has reduced our mean time to detect. Previously, it took me around ten to fifteen minutes, but with SentinelOne Singularity Cloud Security, it takes around seven to eight minutes to resolve an issue. There is often a 60% to 70% reduction. It has also reduced our mean time to remediate by about 45%.
Sai Pradeep Koneti - PeerSpot reviewer
Goes deep into the docker files and find out vulnerabilities
When we were trying to get it up and working initially, I found it a bit hard to go through JFrog Xray's documentation and get my error solved. I was facing some issues because we hadn't got a specific license for the tool, but I was able to access it. As a regular user, I regularly saw an error message saying that the license feature was unavailable for my subscription. After a couple of days, I realized I was missing a license. I had to go back to the JFrog Xray team, who provided me with the new license, and then I could complete the setup.
Utsav Sharma - PeerSpot reviewer
Maintain operational efficiency by detecting misconfigurations and vulnerabilities
The vulnerability scanning feature is excellent as it supports various container capabilities like Docker and Sharma. It also offers repository scanning in the source code domain, allowing pre-push code scans. The misconfiguration detection works well for CloudFormation, Docker files, and Terraform. Its compliance support, like NIST, ensures that configurations align with standards. Trivy helps me significantly detect misconfigurations missed by the ops engineers or in Terraform by the naked eye. It ensures that my deployments are free of misconfigurations and vulnerabilities.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"SentinelOne Singularity Cloud Security offers valuable scalability suitable for organizations of all sizes, from small businesses to large enterprises."
"Cloud Native Security offers attack path analysis."
"The GUI is one of the best features. Audit reports and documentation for alerts are also valuable."
"Visibility is the most important aspect."
"The most valuable aspect of Singularity Cloud Security is its unified dashboard."
"Cloud Native Security's evidence-based reporting allows us to prioritize issues by understanding their impact, helping us resolve the most important problems first."
"The key strength of Singularity Cloud Security lies in its ability to pinpoint vulnerabilities in our cloud accounts and identify suspicious activity that warrants further investigation."
"Its performance impact on the systems is low, which means there is a minimal impact on system performance compared to traditional antivirus solutions."
"JFrog Xray shows us a list of vulnerabilities that can impact our code."
"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."
"JFrog Xray's reporting feature has a lot of options in it, including scanning."
"Good reporting functionalities."
"The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy."
"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."
"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."
"The solution is stable and reliable."
"I rate Trivy a nine out of ten."
"Trivy is particularly useful for checking if Docker images have critical vulnerabilities before they reach production."
"Trivy is very reliable and always has an up-to-date database to scan images and identify vulnerabilities."
"Trivy is easy to integrate with CI/CD and can be installed on desktops to scan images."
"It's customizable, allowing me to add any rules and format HTML templates as I wish."
"Trivy's open source nature and wide functionality are incredibly valuable."
"It is open-source."
"Trivy's open source nature and wide functionality are incredibly valuable."
 

Cons

"Once all components, including the cloud piece and container runtime piece, integrate further and incorporate an AI layer for better comprehension, it will greatly enhance the utility of Singularity Cloud Security."
"There is no break-glass account feature. They should implement this as soon as possible because we can't implement SSO without a break-glass feature."
"I would prefer to see SentinelOne Singularity Cloud Security develop into a single pane of glass for ASPM and CSPM."
"The main area for improvement I want to see is for the platform to become less resource-intensive. Right now, it can slow down processes on the machine, and it would be a massive improvement if it were more lightweight than it currently is."
"SentinelOne Singularity Cloud Security could be improved with easier integrations to the Singularity Data Lake, particularly for various vendors."
"In version 2, a lot of rules have been deployed for Kubernetes security and CDR, which makes a lot of issues of critical severity, whereas they are not critical or of high severity. There is a mismatch of severities."
"Singularity Cloud Security currently lacks a break-glass account function, which is a critical component for implementing Single Sign-On as it allows for regaining access in emergencies."
"The Infrastructure as Code service available in SentinelOne Singularity Cloud Security and the services available in AWS cloud security can be merged so that we can get the security data directly from AWS cloud in SentinelOne Singularity Cloud Security. This way, all the data related to security will be in one single place. Currently, we have to check a couple of things on SentinelOne Singularity Cloud Security, and we have to validate that same data on the AWS Cloud to be sure. If they can collaborate like that, it will be great."
"X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL."
"The speed of JFrog Xray should improve. Other solutions have better performance."
"Since we have been using the solution via APIs, there are some limitations in the APIs."
"JFrog Xray's documentation and error logging could be improved."
"JFrog Xray does not have a dashboard."
"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."
"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."
"Lacks deeper reporting, the ability to compare things."
"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."
"The reporting could be a little better. When integrating Trivy with CI, the interpretation of the reports could be improved."
"The main area for improvement is in differentiating between OS and application-based vulnerabilities."
"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."
"The reporting could be a little better."
"A dynamic scanning capability during runtime would be a significant advantage."
"For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools. That would be my suggestion."
"Trivy can improve by providing an output in PDF format."
 

Pricing and Cost Advice

"It is not that expensive. There are some tools that are double the cost of PingSafe. It is good on the pricing side."
"I am not involved in the pricing, but it is cost-effective."
"SentinelOne offers excellent pricing and licensing options."
"We have an enterprise license. It is affordable. I'm not sure, but I think we pay 150,000 rupees per month."
"The pricing tends to be high."
"SentinelOne Singularity Cloud Security is on the costlier side."
"Singularity Cloud Workload Security's pricing is good."
"Its pricing is constant. It has been constant over the previous year, so I am happy with it. However, price distribution can be better explained. That is the only area I am worried about. Otherwise, the pricing is very reasonable."
Information not available
Information not available
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
851,604 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
15%
Manufacturing Company
9%
Government
6%
Financial Services Firm
25%
Computer Software Company
12%
Manufacturing Company
12%
Government
5%
Computer Software Company
15%
Financial Services Firm
14%
Manufacturing Company
11%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about PingSafe?
The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...
What needs improvement with PingSafe?
The price is on the higher side. The dashboard can be more detailed.
What do you like most about JFrog Xray?
JFrog Xray shows us a list of vulnerabilities that can impact our code.
What needs improvement with JFrog Xray?
X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL. More support ...
What is your primary use case for JFrog Xray?
Our primary use case for X-ray includes multiple activities such as security and vulnerability scanning. We already u...
What needs improvement with Trivy?
Trivy's marketing and awareness need improvement. Not everyone knows about it, which isn't ideal given its capabiliti...
What is your primary use case for Trivy?
I use Trivy ( /products/trivy-reviews ) to scan code for vulnerabilities before deployment. Our projects, which are d...
What advice do you have for others considering Trivy?
I recommend Trivy to others due to its powerful and useful features. However, I suggest increasing its marketing to r...
 

Also Known As

PingSafe
JFrog Security Essentials
No data available
 

Overview

 

Sample Customers

Information Not Available
google, amazon, cisco, netflix, oracle, vmware, facebook
Information Not Available
Find out what your peers are saying about JFrog Xray vs. Trivy and other solutions. Updated: April 2025.
851,604 professionals have used our research since 2012.