No more typing reviews! Try our Samantha, our new voice AI agent.

Sysdig Secure vs Trivy comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Container Security
11th
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
41
Ranking in other categories
Vulnerability Management (10th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (7th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
Sysdig Secure
Ranking in Container Security
21st
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
12
Ranking in other categories
Cloud Security Posture Management (CSPM) (28th), Cloud-Native Application Protection Platforms (CNAPP) (18th), Cloud Detection and Response (CDR) (9th), AI Observability (28th)
Trivy
Ranking in Container Security
5th
Average Rating
8.6
Reviews Sentiment
7.5
Number of Reviews
12
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of August 2026, in the Container Security category, the mindshare of Qualys TotalCloud is 1.7%, up from 1.0% compared to the previous year. The mindshare of Sysdig Secure is 2.5%, down from 2.6% compared to the previous year. The mindshare of Trivy is 2.6%, down from 5.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security Mindshare Distribution
ProductMindshare (%)
Trivy2.6%
Qualys TotalCloud1.7%
Sysdig Secure2.5%
Other93.2%
Container Security
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
MM
DevSecOps Engineer at a outsourcing company with 1,001-5,000 employees
Runtime threat detection has improved and security teams prioritize real Kubernetes risks
The best feature Sysdig Secure offers is threat detection. The threat detection feature on Sysdig Secure stands out compared to other solutions I have seen or used because Sysdig sees the actual behavior inside the container or kernel and correlates it with Kubernetes infrastructure, which makes detection both earlier and more precise in a cloud-native environment. Sysdig Secure has positively impacted our organization by improving visibility into our Kubernetes environment and focusing on real risk, which has reduced alert noise, improved threat detection at runtime, and made vulnerability management more efficient by prioritizing issues that actually affect running workloads.
Utsav Sharma - PeerSpot reviewer
Senior Security Consultant at Ernst & Young
Maintain operational efficiency by detecting misconfigurations and vulnerabilities
The vulnerability scanning feature is excellent as it supports various container capabilities like Docker and Sharma. It also offers repository scanning in the source code domain, allowing pre-push code scans. The misconfiguration detection works well for CloudFormation, Docker files, and Terraform. Its compliance support, like NIST, ensures that configurations align with standards. Trivy helps me significantly detect misconfigurations missed by the ops engineers or in Terraform by the naked eye. It ensures that my deployments are free of misconfigurations and vulnerabilities.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The agent and agentless scanning in TotalCloud, particularly the FlexScan method, is incredibly valuable. With traditional scanning approaches, we had to give IP ranges and whitelist IPs. All that is now simplified. FlexScan requires minimal intervention, and after configuration, it automatically collects data and performs necessary scans."
"Qualys TotalCloud helps you not just to identify misconfigurations, but you can actually also fix issues."
"Qualys TotalCloud has significantly reduced our workload in terms of managing risks, helping us to be more efficient and save substantial resources."
"Qualys TotalCloud provides unified vulnerability and threat assessment for IaaS and SaaS and a single prioritized view of risk, which helps reduce my workload by not having to combine multiple sources."
"Qualys TotalCloud provides a single, prioritized view of risk, reducing the workload associated with consolidating multiple sources for risk prioritization."
"One of the features I appreciate is the ability to generate daily reports without relying on anyone else."
"TotalCloud provides the easiest and the best approach for cloud infrastructure management."
"While automatic inventory detection upon connection is a helpful feature, a truly valuable capability would be assessing an environment's security posture against Azure and CIS best practices."
"We appreciate this feature, especially when combined with CD monitoring. The implementation of requested features has been remarkable, such as scanning for compliance in CRM processes for the US government. We heavily rely on this feature to assess compliance with federal requirements."
"From a container-based standpoint, it offers excellent scalability to its users...I would tell those planning to use the solution that, from a container standpoint, it's excellent."
"Sysdig Secure has many strong foundational features like compliance and benchmark, security, network access management, and vulnerability management."
"In terms of measurable outcomes, I have seen a reduction in vulnerabilities, as Sysdig Secure can tell us how many vulnerabilities are present on a day-to-day report basis, which has improved our efficiency by more than 50% and helps us stay compliant with necessary regulations."
"The tool has the capability to conduct scans initially. It can perform scans on your virtual machines, physical machines, containers, and container images. A standout feature is its ability to scan offline container images stored in your container registry. Additionally, it can scan runtime images in your cluster or on your host machine. This allows for the detection of vulnerabilities in running containers, including loaded libraries. Notably, the tool can identify which library vulnerabilities are already present in your system. An added advantage is its capacity to take action beyond threat detection. It has the ability to block access and respond to encountered threats."
"I have not seen any stability issues so far."
"Sysdig Secure has positively impacted our organization by improving visibility into our Kubernetes environment and focusing on real risk, which has reduced alert noise, improved threat detection at runtime, and made vulnerability management more efficient by prioritizing issues that actually affect running workloads."
"I see Sysdig as the most comprehensive solution in comparison to its competitors."
"It is open-source."
"One of the great features of Trivy is that it helps me scan items such as AWS credentials and GCP service accounts."
"Overall, I would rate Trivy a ten out of ten."
"Trivy is very reliable and always has an up-to-date database to scan images and identify vulnerabilities."
"The most valuable feature of Trivy is its easy integration with the CI/CD pipeline."
"I rate Trivy a nine out of ten."
"I can see vulnerabilities in the images of any applications deployed in the Kubernetes environment or as container applications."
"Trivy's open source nature and wide functionality are incredibly valuable."
 

Cons

"The cloud licensing unit system is unclear, especially since "units" aren't well-defined."
"In TotalCloud, I would suggest improvements in policy checks to cater to various inventory types like VPCs, subnets, S3 buckets, or IAMs. There is a lack of data segregation according to criticality or inventory."
"Qualys's ticketing system can be confusing when assigning tasks to individuals, and support could be improved by offering instant call solutions with engineers in addition to ticket replies."
"Qualys TotalCloud's increasing complexity, due to the development and deployment of multiple solutions, is making the GUI difficult to navigate."
"The areas in the solution that have room for improvement include the UI/UX design, which should be improved, and they should integrate more artificial intelligence into the product."
"There is room for improvement in vulnerability scanning, particularly for PaaS environments. Currently, Qualys does not have full access to these instances, which limits its effectiveness."
"The support is not up to the mark and seems to be overburdened."
"One of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue."
"Sysdig Secure works well for us, but there are a few areas for improvement, such as the alerting and notification system being more flexible for complex workflows, and some dashboard and reporting features could be more customizable to match specific team needs."
"The solution needs to improve overall from a CSPM standpoint since they can't compete with Wiz or Orca."
"Sysdig Secure needs to scale more for complete cloud-native coverage."
"The dashboard could be more simple and show the more important issues that are detected first. We'd like to be able to set it up so more important issues show up more prominently in the dashboard."
"Banks and financial institutions cannot use Sysdig Secure because it doesn't sell SaaS-hosted versions for under two hundred working nodes."
"Reporting can definitely be better. Live dashboards should be configurable for a longer period of time rather than 30 days. Being able to go back in time to compare six months ago to today would be valuable."
"I give it an eight because of the bugs, specifically the fix version bug where sometimes there is no fix version shown, and I wish Sysdig Secure would create a customizable UI that orders features by importance to enhance user experience."
"Perhaps, it could support more custom implementations, as our company utilizes custom implementations rather than standard ones. Configuring it requires a deep understanding and adjustment to our specific needs, which took some time. Other than that, I'm unsure about potential improvements. We were considering the possibility of compartmentalizing their tools. Currently, in Sysdig Secure, they bundle multiple features, and we are unable to use them individually. For instance, if we only need compliance scanning, we have to deploy the entire secure package. This is because of the way their agent functions, but I can't delve into more details."
"Having little experience can hinder the ability to connect it to a user-friendly UI effectively."
"The only problem is that Trivy does not support reporting features such as generating reports in CSV, which is useful for auditing and reporting."
"Trivy can improve by providing an output in PDF format. Additionally, it takes longer to scan container images built with many layers."
"One drawback I have observed with Trivy is the difficulty in building or integrating a UI, particularly for an operator in the NetSuite example."
"In our CI/CD pipelines, Trivy lacks built-in functionality for report analysis."
"Currently, the container image scanning is static. A dynamic scanning capability during runtime would be a significant advantage."
"Trivy generates many false positives, flagging non-existent vulnerabilities. Improvements could include better contextual analysis or granular filtering."
"For malware detection, I need to use two tools: Trivy as my anomaly scanner and ClamAV. I am integrating these two tools into the CI pipeline. If both malware and anomaly detection could be managed by one tool, I would not need to depend on two tools. That would be my suggestion."
 

Pricing and Cost Advice

"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"TotalCloud's price is about right where I would expect it to be."
"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"The cost is high, but it meets our organizational needs."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
"Qualys TotalCloud offers cost-effective licensing flexibility."
"The solution's pricing depends on the agents...In short, the price depends on the environment of its user."
"Sysdig is competitive. The quality matches the pricing. Obviously, everyone wants things to be cheaper, but if you're realistic, you acknowledge that quality service comes with a price. Sysdig is the gold standard for Kubernetes, and I wouldn't choose anything else. We live in Kubernetes. Everything is containerized, so that means a lot to us, and we're willing to make an investment."
"I am always going to say that it could be a little bit cheaper. I do feel that it is a little bit on the expensive side."
"It is quite costly compared to other tools."
"In comparison to other cloud solutions, it's reasonably priced. However, when compared to in-house built open-source projects, it might be considered somewhat costly. The cost depends on whether someone sees the support provided by Sysdig as an advantage or if it's deemed unnecessary. Personally, I find the support to be excellent and consider it a good value."
Information not available
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
908,834 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
13%
Outsourcing Company
12%
Comms Service Provider
10%
Financial Services Firm
10%
Financial Services Firm
16%
Computer Software Company
11%
Manufacturing Company
9%
Comms Service Provider
8%
Financial Services Firm
13%
Manufacturing Company
11%
Computer Software Company
9%
Comms Service Provider
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise5
Large Enterprise30
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise2
Large Enterprise5
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise1
Large Enterprise9
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is vulnerability management and exposure management. I use this tool to evalua...
What needs improvement with Sysdig Secure?
Sysdig Secure works well for us, but there are a few areas for improvement, such as the alerting and notification sys...
What is your primary use case for Sysdig Secure?
Our primary use case for Sysdig Secure is runtime threat detection and vulnerability management.
What advice do you have for others considering Sysdig Secure?
My advice for others looking into using Sysdig Secure is to clearly define your primary use case before getting start...
What needs improvement with Trivy?
Trivy's marketing and awareness need improvement. Not everyone knows about it, which isn't ideal given its capabiliti...
What is your primary use case for Trivy?
I use Trivy ( /products/trivy-reviews ) to scan code for vulnerabilities before deployment. Our projects, which are d...
What advice do you have for others considering Trivy?
I recommend Trivy to others due to its powerful and useful features. However, I suggest increasing its marketing to r...
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
No data available
 

Overview

 

Sample Customers

Information Not Available
SAP Concur, Goldman Sachs, Worldpay, Experian, BigCommerce, Arkose Labs, Calendly, Noteable, Bloomreach. More here: https://sysdig.com/customers/
Information Not Available
Find out what your peers are saying about Sysdig Secure vs. Trivy and other solutions. Updated: June 2026.
908,834 professionals have used our research since 2012.