alternatives to
Hosted security platform that scans dependencies, container images, code and infrastructure as code for known vulnerabilities. A closed product from Snyk.
| Tool | Fit | Stars | Licence | Terms | Self-hosted | Language | Latest | Last push |
|---|---|---|---|---|---|---|---|---|
| Trivy | Partial | 38k | Apache-2.0 | Open source | No | Go | v0.75.0 | 2026-10-06 |
| Grype | Partial | 13k | Apache-2.0 | Open source | No | Go | v0.120.0 | 2026-10-05 |
| OSV-Scanner | Partial | 11k | Apache-2.0 | Open source | No | Go | v2.6.0 | 2026-10-05 |
| Clair | Partial | 11k | Apache-2.0 | Open source | No | Go | v4.9.0 | 2026-09-30 |
| Checkov | Partial | 9.1k | Apache-2.0 | Open source | No | Python | 3.3.23 | 2026-10-06 |
| Dependency-Check | Partial | 7.7k | Apache-2.0 | Open source | No | Java | v13.0.0 | 2026-10-05 |
| Dependency-Track | Partial | 4.3k | Apache-2.0 | Open source | Yes | Java | 5.1.2 | 2026-10-06 |
| KICS | Partial | 2.7k | Apache-2.0 | Open source | No | Open Policy Agent | v2.2.0 | 2026-10-06 |
8 alternatives
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Scans dependencies, container images, infrastructure as code and secrets from the CLI or CI; no hosted dashboard or fix pull requests.
A vulnerability scanner for container images and filesystems
Dependency and container image scanning, from an image, a directory or an SBOM; no code or IaC scanning.
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
Dependency and container image scanning against OSV.dev, with guided remediation for npm and Maven.
Vulnerability Static Analysis for Containers
Container image scanning as a service behind a registry; no code or dependency scanning.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Only the infrastructure as code checks, for Terraform, CloudFormation, Kubernetes and more.
OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
Dependency scanning against the NVD, with Maven, Gradle and Ant plugins; no container image scanning.
Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
Continuous monitoring of dependencies from SBOMs with policies, without fix pull requests.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Only the infrastructure as code checks, with queries for Terraform, Kubernetes, Docker and more.